Hacker News Reader

I saw this happen recently and the account holder only got notified of the massive increase in transactions a day after the API key was cycled.

I heard about this happening yet again too last month - August seems to have been the month of Stripe key leaks.

View on HN

Would suggest using webhooks to customize and trigger alerts (https://stripe.com/docs/webhooks), or turning on payment notifications (https://support.stripe.com/questions/set-up-account-email-no...).

But the best way to prevent this is to absolutely make sure secret keys are kept secret! We try to scour for leaks in the wild—and notify the owner directly—but can’t see everything.

Reply on news.ycombinator.com