PatchVault › Errors › Vibe-coded app security

const stripe = new Stripe('sk_live_...')

A live Stripe secret key is written straight into a source file. Anyone with the repository, a build artifact or a leaked bundle can create charges and refunds and read customer data.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/vibe-security-scan.py) .

Why it happens

Stripe secret keys (sk_live_) have unrestricted API access. Stripe's docs say to keep them out of client code and source control, store them in a secrets manager or server environment variable, and prefer restricted keys (rk_) with minimal permissions.

Manual fix

1. Roll the key in the Stripe Dashboard (Developers > API keys).
2. Read it from the environment: new Stripe(process.env.STRIPE_SECRET_KEY)
3. Prefer a restricted key with only the permissions this service needs.
4. Remove the old key from git history.

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

• Stripe docs: API keys
• Stripe docs: best practices for managing secret API keys

Related errors

• GH013: Push cannot contain secrets: fix
• Supabase "new row violates row-level security policy"
• Supabase rls_disabled_in_public: table publicly accessible
• NEXT_PUBLIC_ service_role key: your Supabase admin key is in the browser bundle
• CORS: Access-Control-Allow-Origin '*' with credentials fails (and why * is risky)

Full guide and free terminal scanner: Vibe-coded app security fix bundle. Last checked 2026-10-31.