> ## Documentation Index
> Fetch the complete documentation index at: https://learn.nexudus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NXD-2023-001

> A live Stripe secret API key was publicly exposed in the developer documentation, enabling unauthorized access to payment operations.

# Security Advisory: Stripe Secret Key Exposure in Documentation

| Field | Value |
| - | - |
| **Advisory ID** | NXD-2023-001 |
| **Published** | 2023-03-05 |
| **Severity** | Critical (CVSS 3.1 Base Score: 9.1) |
| **CWE** | CWE-798 — Use of Hard-coded Credentials |
| **Affected Product** | Nexudus Developer Documentation / Stripe Integration |
| **Status** | Disclosed |

***

## Summary

A live Stripe secret API key (`sk_live_…`) was inadvertently included in API request examples on the public Nexudus developer documentation site. This key provided full access to a Stripe account.

***

## Vulnerability Details

### What happened?

The Nexudus REST API documentation at `https://developers.nexudus.com/reference/get-invoices` included a live Stripe secret key in example API requests. Stripe secret keys (prefixed `sk_live_`) grant full programmatic access to the associated Stripe account without additional authentication.

### Root Cause

A live production credential was used in documentation examples instead of a placeholder or test-mode key (`sk_test_`). This key was committed to the documentation source and rendered publicly on the developer portal.

***

## Impact

With the exposed key, an attacker could:

### 1. Enumerate Connected Accounts & Contacts

List all connected Stripe accounts, exposing business names, email addresses, and account metadata.

### 2. Create Unauthorized Charges

Initiate charges against any connected account's stored payment methods (credit/debit cards), billing arbitrary amounts to Nexudus clients.

### 3. Issue Unauthorized Refunds

Refund previous legitimate charges, causing financial loss and accounting discrepancies for affected businesses.

### 4. Access Payout History

View full payout history including amounts, dates, and bank account details — exposing confidential financial data.

### 5. Additional Operations

Access to balance transactions, disputes, customer records, subscriptions, and other Stripe API resources associated with the account.

***

## Impact Assessment

| Category | Impact |
| - | - |
| Confidentiality | Full exposure of client email addresses, business names, payment methods (partial card numbers), and payout history |
| Integrity | Unauthorized charges and refunds could be issued against any connected account |
| Availability | Mass refunds or disputes could disrupt payment processing for all connected businesses |
| Financial | Direct financial loss through unauthorized charges or refunds across the entire client base |

***

## Exploitation Prerequisites

* **Authentication Required:** No — the key was publicly accessible in documentation.
* **Technical Skill:** Minimal — standard Stripe API calls with the exposed key.
* **Tools Required:** Any HTTP client (curl, Postman, or the Stripe CLI).

***

## Remediation

1. **Remove the exposed key** from all documentation pages and source repositories.
2. **Rotate the compromised key** — generate new Stripe API keys and update all services using the old credentials.
3. **Audit Stripe logs** — review Stripe's request logs for any unauthorized usage during the exposure window.
4. **Use test keys in documentation** — ensure only `sk_test_` keys or clearly-marked placeholders (e.g., `sk_live_YOUR_KEY_HERE`) appear in public examples.
5. **Implement secret scanning** — enable automated secret detection in CI/CD pipelines and documentation publishing workflows to prevent future credential leaks.

***

## Timeline

| Date | Event |
| - | - |
| 2023-03-01 | Stripe live key included in developer documentation |
| 2023-03-08 | Vulnerability reported to Nexudus |
| 2023-03-08 | Key rotated and removed from documentation |
| 2026-06-08 | Public disclosure |

***

## Credit

Reported by Efran via responsible disclosure.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.