"Add a Stripe checkout button": the prompt that leaks your secret key
The naive way to vibe-code a Stripe button puts your secret key in every visitor's browser. Here's the same request three ways, with the real code —…
Aliteq
Sam Ortega · Build Editor
The short answer
A Stripe checkout button is easy to fake and easy to get dangerously wrong. The unsafe version puts your secret key in the browser; the safe version creates the checkout session on your server and…
Never put the Stripe secret key (sk_…) in client code — it can charge and refund on your account.
Create the Checkout Session on the server; the browser just gets a URL to redirect to.
Only a verified webhook may mark something paid — a browser redirect can be faked.
Aliteq
Read the full story
"Add a Stripe checkout button": the prompt that leaks your secret key