50,000 Stripe API Secrets Exposed in Public Repositories and Server Misconfigurations
What Happened — Researchers from Ransomnews identified more than 50,000 live Stripe secret keys leaked across public GitHub repositories, GitHub Actions logs, and mis‑configured web servers. A sample of the keys was still active, allowing attackers to list customers, create fraudulent charges and modify webhooks within hours.
Why It Matters for Compliance & Audit Readiness
- Exposed credentials are a classic failure of SOC 2 CC6.1 (Logical Access) and CC6.2 (System Operations) controls; continuous monitoring of secret management is required to prove compliance.
- Demonstrates the need for documented secure‑development policies (code reviews, secret scanning) and evidence that they are enforced across the software supply chain.
- Provides audit‑ready proof points for “least‑privilege” and “segregation of duties” controls when you can show that secret rotation and access revocation are performed promptly.
Who Is Affected — Payment processors, SaaS platforms that embed Stripe, and any merchant that stores Stripe keys in code or server configs (across retail, e‑commerce, SaaS, and fintech).
Recommended Actions
- Map the incident to SOC 2 CC6.1/CC6.2 controls, capture evidence of secret‑scanning tools and key‑rotation logs.
- Implement automated CI/CD secret detection (e.g., GitHub secret scanning, SAST) and enforce environment‑variable masking in build pipelines.
- Conduct a rapid key rotation for all discovered secrets and audit the process as part of your continuous‑compliance program.
Technical Notes – Leaked keys were harvested from: (1) public or accidentally public GitHub repos (hard‑coded .env files, comments), (2) GitHub Actions logs where secrets were printed unmasked, and (3) over 3,000 mis‑configured web servers exposing Stripe strings; ~12 % of those keys were still functional. Source: SecurityAffairs