Stripe secret key

How it is detected

Matches `sk_live_` and `sk_test_`, then reads the surrounding code. Clerk issues secret keys in exactly this format and nothing in the string distinguishes them, so when only Clerk is referenced nearby the finding is attributed to Clerk, when both are the finding names both, and a `sk_test_` key is reported at medium because no real money can move.

If you find one

1. 1Roll the key in the Stripe dashboard. Rolling issues a replacement and revokes the old key.
2. 2Review recent charges, refunds and payouts for anything you did not initiate.
3. 3Move the Stripe call into a server route. The browser only ever needs the publishable key.

Where it turns up

Most often in checkout flows an agent wired up client-side.

Fix it in your stack

• Lovable
• Bolt.new
• Cursor
• Claude Code
• Replit
• Next.js