Vercel
Security & compliance
Releases
Live Stripe secret key exposed via NEXT_PUBLIC_ prefix
Part of the Public env exposure check · fix arrives as a guide
What it is
A live Stripe secret key is assigned to a NEXT_PUBLIC_ prefixed environment variable.
Why it matters
The prefix inlines the value into the client bundle, so the key is in the JavaScript every visitor downloads. A live Stripe secret key can charge cards, issue refunds, and read your customer records.
How to fix it
Roll the key in the Stripe dashboard immediately — it is compromised — then move it to a server-only variable. The browser should only ever hold the publishable key.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.