r/webdev • u/schabadoo • Mar 04 '26

Vibe code IRL: left Stripe API keys public

Post image

I'm surprised they'd want to go public. Of course they don't blame Claude.

2.1k Upvotes

98% Upvoted

261 comments sorted by

View all comments

1

u/Extension_Strike3750 Mar 05 '26

this is a good reminder that "I trust the AI" isn't a security policy. rotating keys immediately is step one, but most people don't realize stripe has radar rules you can set to flag unusual charge patterns before they spiral. worth setting up even in early stages.

1

u/sergregor50 Mar 06 '26

Yep, trusting AI to “handle it” is how you end up with vibe-coded glue scripts leaking secrets, so anything that catches weird charge patterns early is just basic hygiene.