Hacker News Reader

Yes, this seems like some sort of card testing attempt. Glad most of the fraud was caught. Not sure if you’re the author, but I’d like to see how we could’ve helped better. Could you forward me your thread with support at edwin@stripe.com? Also, if you haven’t implemented them yet, I might recommend looking into CAPTCHA and rate limiting to help prevent future attempts.

View on HN

The author is a friend of mine but I've passed your comment on to him.

Thanks!

Appreciate it. Just connected with him.

I saw this happen recently and the account holder only got notified of the massive increase in transactions a day after the API key was cycled.

I heard about this happening yet again too last month - August seems to have been the month of Stripe key leaks.

Would suggest using webhooks to customize and trigger alerts (https://stripe.com/docs/webhooks), or turning on payment notifications (https://support.stripe.com/questions/set-up-account-email-no...).

But the best way to prevent this is to absolutely make sure secret keys are kept secret! We try to scour for leaks in the wild—and notify the owner directly—but can’t see everything.

Reply on news.ycombinator.com