50,000 Stripe Secrets Leaked in Public Code
Over 50,000 Stripe merchant API keys leaked via public code and logs; 659 merchant accounts' data offered on trading forum.
Ransomnews researchers identified over 50,000 unique Stripe merchant API keys exposed in public GitHub repositories, GitHub Actions logs, and misconfigured web servers. A dataset on a data-trading forum dated August 18, 2026 contained live keys for 659 merchant accounts plus roughly 35 GB of customer and payment data. Researchers demonstrated a leaked key enabled accessing customer lists, creating fraudulent payment links, and making test charges within 17 hours. Stripe itself was not compromised; over 3,000 misconfigured web servers revealed Stripe-related strings, with about 12% containing working keys.
- 659 merchant accounts with live API keys plus 35 GB of data published on trading forum
- Exposed keys allow listing customers, creating charges, issuing refunds, and modifying webhooks
- GitHub Actions build logs and hardcoded keys in .env files are major leak sources
- Stripe's GitHub secret scanning is opt-in, doesn't cover private repos or build logs
- Some merchants rotated keys but left old keys active unintentionally
- Vendors
- StripeGitHubRansomnews
- Products
- Stripe APIGitHub Actions
- Victims
- Stripe merchants
- Organizations
- StripeRansomnewsGitHub
From the original article
3 min read at securityaffairs.com
Over 50,000 exposed Stripe API keys show how leaked secrets can enable fraud, data access and account abuse within hours. Ransomnews researchers have documented a large-scale leak of Stripe merchant API keys found exposed in public code repositories, GitHub Actions logs, and misconfigured web servers, with over 50,000 unique keys identified in total.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.