Your Stripe key is on GitHub. Do this now, in this order.
Deleting the file doesn't help. The key is still live until you rotate it, and it's still readable in git history until you remove it from there too. Here's the order that actually matters. Step 1 (right now): rotate the key in Stripe Go to dashboard.stripe.com/apikeys in live mode. Find the exposed secret key, open its overflow menu, and choose Rotate key . In the expiration dropdown, pick Now —…
If your Stripe secret key has been exposed on GitHub, it's crucial to act quickly. Rotating the key in Stripe is step one, and it's the only step that will immediately disable the key. The key remains readable in Git history until you remove it, so you must also clean the history from the repository. After rotating the key, you should check the Stripe dashboard for any unusual activity.
If the key was used, Stripe support can help assess the damage. After all that, remove the key from the Git history. This process is vital because even after you delete the file and push the change, the key can still be found in previous commits through a Git log. These steps are essential because GitHub's secret scanning doesn't cover private repositories and there's still a window between the push and detection where the key remains live.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
