Source code
Security & compliance
Secret-key exposure
Part of the Payment safety check · fix arrives as a guide
What it is
A payment provider secret key is reachable from client code or committed to the repository, rather than being confined to the server.
Why it matters
The secret key can charge, refund, and read your customer records. It is the most valuable credential in most applications, and the publishable key that belongs in the browser is a different string entirely.
How to fix it
Roll the key in the provider dashboard immediately, then move all calls that use it behind server routes. The client should only ever hold the publishable key.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.