1,033 live Stripe secret keys were exposed from 669 vendors after .env files and debug logs were left reachable on the public internet. The keys let anyone create charges, pull invoices and harvest customer details – a breach that can drain wallets and ruin reputations in minutes.

What triggered the leak

Developers routinely store configuration data – database passwords, API tokens and Stripe secret keys – in a file named .env. The file lives alongside source code and is read at runtime to keep secrets out of the codebase. The practice works only if the server never serves files that start with a dot. In this case, mis-configured web servers (both Nginx and Apache) allowed requests for “/.env”, “/.env.example”, “/.git/HEAD” and a custom “/debug” endpoint to return the raw file with a 200 OK status.

The leak was not caused by a vulnerability in Stripe’s platform, nor by a flaw in any specific e-commerce plugin. It was pure exposure of files that should have been invisible to the world.

Why the exposure matters

A Stripe secret key is effectively a master password for a merchant’s payment rail. Anyone who holds it can:

  • Create arbitrary charges on stored cards
  • Retrieve invoices and payout histories
  • Pull personal data – names, emails, phone numbers, home addresses, IP addresses
  • Redeem promotional codes for free or discounted purchases

The leaked data set included all of the above, plus payout details that reveal how much each vendor earned. For a business, the immediate risk is fraudulent transactions that generate chargebacks, loss of customer trust, and potential fines under PCI-DSS, GDPR or other data-privacy regimes. The long-term cost can be far higher: legal fees, remediation expenses, and a damaged brand that may never recover.

Quick test: is your .env exposed?

Open a terminal and replace yourdomain.com with your own host name:

for p in "/.env" "/.env.example" "/.git/HEAD" "/debug"; do
  echo -n "$p -> "
  curl -s -o /dev/null -w "%{http_code}\n" "https://yourdomain.com$p"
done

Every line should return 403 (forbidden) or 404 (not found). A 200 response means the file is publicly readable – a critical security incident that needs immediate attention.

Immediate remediation steps

1. Block dotfiles at the web server

  • Nginx – add a location block that denies any request for files beginning with a dot.
  • Apache – use a FilesMatch directive in .htaccess to return a 403 for dot-prefixed files.

2. Harden your Docker workflow

  • Add .env to .dockerignore so the file never gets copied into the image.
  • Avoid using the COPY instruction for any file that contains secrets.

3. Rotate every compromised key

  • Log into the Stripe Dashboard → Developers → API keys.
  • Generate a new secret key and revoke the old one immediately.

4. Adopt least-privilege keys

  • Stop using a single secret key for all operations.
  • Create restricted keys that only allow the actions required – e.g., a checkout service needs permission to create payment intents but not to issue refunds or view payouts.

5. Purge every copy of the old key

  • Scan CI/CD logs, build artifacts and backup archives.
  • Run secret-scanning tools such as Gitleaks or TruffleHog against your Git history.

A leaked key does not disappear when you delete the file from the server; it lives forever in the hands of whoever downloaded it. Rotation is the only way to render the stolen data useless.

Beyond the fix: building a safer pipeline

  • Automated scanning – integrate secret-detection into every pull request and CI job.
  • Configuration management – store secrets in a dedicated vault (e.g., HashiCorp Vault, AWS Secrets Manager) and inject them at runtime rather than relying on static files.
  • Access reviews – periodically audit which Stripe keys are active and what permissions they hold.

These practices reduce the chance that a single mis-configured server can expose the entire payment infrastructure.

What to watch next

The security community is already searching for additional exposed keys using the same methodology. Expect more disclosures as automated scanners crawl the web for “/.env” files containing Stripe tokens. Stripe may issue additional guidance on key rotation cadence and recommend restricted keys for high-risk operations.

Takeaway

If a dotfile can be fetched with a browser, your payment system is already compromised – block the file, rotate the key, and redesign your secret-handling workflow before fraud hits your ledger.