By Get an engineer for this one. Rotate the key now, then move Stripe calls to a server.
- How serious
- Critical
- Fix it yourself?
- No, get an engineer
- Typical cost
- €99–$990 for a single fix, or $1,500–$15,000 if payments need rebuilding (prices)
- Top rated for Lovable
- Afterbuild Labs · 10.0/10
What you see. A key starting with sk_live_ or sk_test_ appears in your app's browser code, your GitHub repo, or a NEXT_PUBLIC_ variable.
Why it happens
Stripe has two kinds of keys. The publishable key, pk_, is safe in a web page because it can only create tokens from card details. The secret key, sk_, has unrestricted permissions on all Stripe APIs. Anyone who holds it can issue refunds, read customer data, and move money. Stripe says it must stay in your server environment and never in source code or shipped applications.
AI builders expose it in three ways. The agent puts the Stripe call in a browser component. In v0 and other Next.js apps it names the variable NEXT_PUBLIC_STRIPE_SECRET_KEY, and Next.js inlines every NEXT_PUBLIC_ value into the JavaScript sent to the browser. Or the key sits in a committed .env file in the GitHub repo that Lovable syncs. Stripe scans for exposed keys and may deactivate one it finds, but it does not guarantee detection. Treat any exposure as a compromise, even if nothing looks wrong yet.
Fix it yourself
- In the Stripe dashboard, open Developers → API keys, open the key's menu, choose Rotate key, and set the expiration to Now. Copy the new key once.
- Put the new key only in your host's environment settings. In Lovable, use the Secrets area under More. In Vercel, add it without the
NEXT_PUBLIC_prefix. - Search the whole repository, including
.envfiles and Git history, forsk_liveandsk_test. Remove every match and make sure.env*is in.gitignore. - Ask the agent to move every Stripe call that uses the secret key into a server route, server action, or edge function, and to send the browser only the publishable key.
- Check Developers → Logs for requests you do not recognize, and review refunds and payouts for the exposure period.
- Create a restricted key with only the permissions the app needs and use it in place of the full secret key.
When to get an engineer
Rotate the key yourself first, that part cannot wait. Then hire if Stripe calls live in several browser files or if you saw unknown requests in the logs. Tell the engineer when the key was exposed, which files held it, and your host. Moving payments to the server is a single fix at €99–$990 in 1–3 days. If the whole payment flow was built in the browser, expect a payments rebuild inside a cleanup at $1,500–$15,000.
Top-rated companies for Lovable apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
Check these
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
Secrets live in the host's environment settings
Keys belong in environment variables on the server, not in the repository or in front-end code.
Paid accounts are unlocked by a verified payment webhook
Access should change only when your server receives a signed webhook from Stripe or your provider, not when the browser reaches a success page.
Prices and plans come from the server
If the price or plan ID is sent from the browser, someone can edit it. The server should look it up.
The code lives in a Git repository you own
Connect GitHub or export the project. If the builder account is lost, the product should not be.
Questions
The key is sk_test_, does it still matter?
Less money is at risk, but it still gives full access to your sandbox and signals that the live key will follow the same path. Rotate it and fix the code before you switch to live keys.
Is the pk_live_ key also a problem?
No. Stripe designs publishable keys to be included in front-end code. It cannot create charges or read account data. Only sk_ and rk_ keys must stay on the server.
Sources: Stripe: API keys; Stripe: Best practices for managing secret API keys; Next.js: Environment variables guide; Lovable: Built-in backend overview.