50,000 Stripe API Keys Exposed
Leaked API keys enable fraudulent transactions within hours.
1Large-Scale API Key Leak
Ransomnews researchers documented over 50,000 Stripe merchant API keys exposed in public code repositories, GitHub Actions logs, and misconfigured web servers. The research team tested a sample of keys and found a significant portion still active. They conducted studies to document how quickly these keys could be exploited for fraudulent purposes.
217 Hours Enough for Fraud
Researchers demonstrated that after finding an active Stripe API key, they could access a merchant's customer list, create a fraudulent payment link, and make a $1 test charge within 17 hours. The fact that a single key alone could perform these operations highlights the risks of exposed credentials and inadequate API protections.
3Capabilities of API Keys
An active Stripe secret key grants extensive permissions including listing customers and their payment methods, creating charges, issuing refunds to attacker-controlled accounts, modifying webhook endpoints to intercept payment notifications, and in some cases accessing connected accounts if Stripe Connect is enabled. A secret key isn't partial access - it's full API authorization.
4Leak Sources
The sources of leaked keys come as no surprise to developer security professionals. GitHub repositories - both public and accidentally made public - account for the majority, typically through hardcoded keys in config files, .env files committed without .gitignore, or keys left in code comments. GitHub Actions build logs are the second major source of exposure.
5Web Server Misconfigurations
Misconfigured web servers represent another significant source of exposed Stripe API keys. Researchers found over 3,000 servers revealing Stripe-related strings, with about 12% containing keys that worked against the Stripe API. The source of 659 exposed merchant keys remains unclear but likely includes infostealer logs, public repos, exposed environment files, and misconfigured backups.
6Data Collector's Advantage
The data collector's real advantage lay in systematically validating keys, accessing each account, and organizing stolen data into a consistent folder structure. While gathering keys is common, validating hundreds of them, systematically exploring each account's API, and archiving results represents a different level of effort and organization.
7Stripe's Current Protections
Stripe does offer automatic secret scanning through GitHub's partner program, which flags Stripe keys in public repositories and can trigger automatic revocation when merchants opt in. However, the opt-in rate remains low, scanning doesn't cover private repos, and has no coverage for build logs, web server misconfigurations, or other platforms where keys might surface.
8Recommended Remediation
Remediation steps are straightforward: audit current Stripe keys against version control history to check for past commits. Rotate any key that has touched a public repo, build log, or unprotected config file. Enable Stripe's restricted keys for integrations that don't need full account access. Implement Stripe Radar rules to flag unusual charge patterns that might indicate unauthorized key usage before you notice it's compromised.
Original article: Security Affairs — 50.000 Stripe API Anahtarı Açığa Çıktı