What a Stripe secret key looks like

Secret keys start with sk_live_ (live mode) or sk_test_ (test mode); restricted keys start with rk_. Publishable keys start with pk_ and are meant to be public, so ScrubLogs leaves them alone.

A fake example, in the right format:

sk_live_51FakeDemoKey4ScrubLogsXyZ09

ScrubLogs replaces it with <STRIPE_KEY_1>.

Why a leak is dangerous

A live secret key can create charges and refunds, read customer and payment data and change account settings. Treat a leaked live key as a payment-security incident.

If yours leaked: rotate it

Redacting a copy doesn’t un-leak the original. If the real value was shared anywhere, replace it:

1. In the Stripe Dashboard open Developers → API keys and choose Roll key on the leaked key.
2. Set the old key to expire now, or after a short grace period if you need time to deploy.
3. Deploy the new key, then review recent events and logs for API calls you didn’t make.
4. Use restricted keys with only the permissions each service needs.