'Exposure of confidential secret or token Stripe secret test key'
Description
The response body contains content that matches the pattern of a Stripe secret test key was identified. Test secret keys are used for accessing and executing test data and functionality. A malicious actor with access to this test key can only simulate access, account objects do not return sensitive fields. Exposing this value could allow attackers to gain access to all resources granted by this token.
Remediation
For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on Credential exposure to the internet.
To rotate your Stripe secret test key:
- Sign in to your Stripe account and access https://dashboard.stripe.com/apikeys
- Ensure "Test mode" is enabled by selecting the toggle in the top menu
- In the "Standard keys" section, find the key that was identified and select the ellipsis in the right-hand side
- Select "Roll key..."
- In the "Roll API key" dialog, select an expiration date, for example "now"
- Select "Roll API Key"
For more information, please see Stripe's documentation on rotating API keys.
Details
| ID | Aggregated | CWE | Type | Risk |
|---|---|---|---|---|
| 798.177 | false | 798 | Passive | High |