Over a thousand live Stripe secret keys dumped online from exposed .env files

A thousand live payment keys posted online

A threat actor published 1,033 active Stripe secret keys belonging to 669 separate vendors on an underground forum on August 18, 2026, according to research by threat-intelligence firm Hudson Rock, summarized in a dev.to write-up. The actor also claimed to be holding roughly 20,000 additional keys to be released in batches — a figure the write-up explicitly flags as an unverified claim, while the 1,033 posted keys were confirmed live.

The archive reportedly contained more than bare keys. Sample JSON entries carried flags indicating charge capability, and invoice-linked spreadsheets included customer names, email addresses, phone numbers, home addresses, purchase-time IP addresses and internal transaction identifiers. Hosted invoice URLs in the dump still resolved to valid Stripe invoices showing the last four digits of cards, and a separate spreadsheet listed promo codes with discount amounts and durations. The actor advertised 33 GB of material but delivered a 2.37 GB archive, a gap the write-up reads as fitting a staged release.

No Stripe flaw, no shared plugin

Two findings steer the analysis away from Stripe or any single dependency. The victims ran unrelated stacks — PHP storefronts, Node services, Python APIs and hosted site builders — so no common plugin or framework connects them. And Hudson Rock's telemetry reportedly found no infostealer infections on the affected vendor domains, ruling out the credential-stealing malware usually behind such leaks.

The leading explanation is mass, automated scanning for publicly reachable .env files and debug output. Probes for paths such as /.env and /.git/HEAD predate this incident and run continuously, so a document root that serves dotfiles, a container image that copies .env into a served directory, or an error page that prints environment variables is enough to be found.

What a live secret key unlocks

A standard sk_live key is not a read-only credential, the write-up emphasizes. Through Stripe's ordinary API it can list customers, invoices and charges; issue refunds, which means the ability to move money; trigger payouts where account settings allow; and enumerate coupons for promo-code abuse. Whoever scans the key inherits the same interface the victim's own backend uses — no exploit required.

The recommended checks and fixes

The write-up lays out a response plan for teams running Stripe integrations:

• Probe your own domains for /.env, /.env.example, /.git/HEAD and /debug; any endpoint that returns secrets is an incident.
• Block dotfiles at the web server, for example with nginx or Apache deny rules, and optionally at the CDN edge, while ensuring the origin itself never serves the file.
• Keep .env out of container images using .dockerignore and BuildKit secret mounts rather than a COPY step.
• Roll the secret key in the Stripe dashboard and revoke the previous value; once a key has been copied, deleting the exposed file closes nothing.
• Replace broad standard keys with restricted keys carrying minimal permissions, such as write access to payment intents plus read access to customers. A leaked restricted key cannot issue refunds or redirect payouts.
• Inventory every other copy: git history, CI logs, backup archives, staging subdomains, environment-sync tools and developer machines, aided by scanners like gitleaks or TruffleHog.
• Review roughly 30 days of Stripe API logs for refunds, payouts and bulk customer or invoice listing from unfamiliar IP addresses, plus origin access logs for /.env probes predating the dump.

Part of a wider pattern

The incident joins a string of recent secrets exposures catalogued on Doppler's breach timeline, as the write-up recounts. It lists roughly 4,576 n8n tokens found on public GitHub in August 2026 with 321 still valid; the March 2026 LiteLLM PyPI backdoor, where CloudSEK estimated about 434,000 potentially exposed pipelines and Hudson Rock's separate analysis put the impact near 2,500 organizations; the poisoned Nx Console VS Code extension from May 2026 with more than 2.2 million installs; and a CISA repository of production secrets reportedly left public for about six months. The common thread is that exposure persists in every copy already taken.

Why it matters

Payment credentials change the calculus of a leak. A compromised restricted key is largely a privacy problem; a standard key with refund and payout scope is a financial one, because it grants programmatic control over real money with no exploit involved. The vector here required no sophistication, only a misconfigured file discoverable by an automated scanner, and it applies equally to hand-managed servers and managed hosting platforms. For anyone operating a Stripe integration, the practical takeaways are a five-minute check of whether .env is web-reachable, immediate rotation if it ever was, and shrinking key scopes so the next leak cannot move funds.