Secret API keys are not exposed to the client-side bundle

A Stripe secret key (sk_live_*) exposed in a client-side bundle or a NEXT_PUBLIC_ environment variable is readable by every visitor who opens DevTools. An attacker can use it to create refunds, list customers, retrieve stored card fingerprints, or cancel subscriptions without touching your server. PCI-DSS 4.0 Req 3.4 prohibits storing or transmitting secret key material outside controlled server environments. OWASP A02 (Cryptographic Failures) flags this as one of the highest-severity credential exposures because the key grants API-level access to your entire Stripe account — charges, payouts, and customer data — to any actor who extracts it from your bundle.

Move the secret key out of any client-side file and any NEXT_PUBLIC_ environment variable. The publishable key (pk_*) is the only Stripe credential that belongs in browser code.

// lib/stripe.server.ts — server-only module
import Stripe from 'stripe'
export const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
  apiVersion: '2024-12-18.acacia',
})

// Client component — only the publishable key
import { loadStripe } from '@stripe/stripe-js'
const stripePromise = loadStripe(process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY!)

Verify .env.example uses STRIPE_SECRET_KEY (no NEXT_PUBLIC_ prefix). If the key was ever committed or bundled, rotate it immediately in the Stripe Dashboard.