Stripe & SupabaseSeverity critical
Stripe secret key exposed client-side
A sk_live_ (or sk_test_) key found in the JavaScript sent to the browser gives anyone full access to the Stripe API: create charges, trigger refunds, list every customer.
Check it in 30 seconds
Open DevTools, Network tab, filter on JS, and search for sk_live_ or sk_test_ in every loaded file.
The fix
Every operation using the secret key must go through a server-side API route, never directly from a client component:
// app/api/create-checkout/route.ts — server only
import Stripe from 'stripe';
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);If a key has already been exposed, rotate it immediately in the Stripe dashboard (Developers → API keys → Roll key) — a public key, even for a few hours, must be treated as compromised.
Full guide with the three most common scenarios that explain how this key ends up exposed:
Read the full articleCheck whether your site is affected by this vulnerability.
Scan my app