Fix · Payments

My payment secret key is in the website code

UrgentSecurity

What you may see

The gateway secret appears in the page source or in GitHub

Most likely cause

Payment secrets must stay on the server; anything in browser code or a public repository is visible to everyone.

Check first (about two minutes)

Search the project and the live page source for the start of the key.

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a very careful senior engineer who knows online payments (including payment gateways used in Kuwait) and explains them to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

THE PROBLEM
My payment secret key is in the website code

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
Payment secrets must stay on the server; anything in browser code or a public repository is visible to everyone.

DO THESE STEPS, IN THIS ORDER
1. FIRST tell me to ask the gateway to rotate or reissue the keys now, and to check recent payments and refunds for anything I do not recognise.
2. Move all calls that use the secret to server code and read the secret from a server-only variable.
3. Remove it from Git history if it was committed (with my approval), and add checks that stop secrets from being committed.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- The old key is dead, the live page source has no secret, and a test payment works with the new key.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not wait to see if someone used it. Rotate first.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

FIRST tell me to ask the gateway to rotate or reissue the keys now, and to check recent payments and refunds for anything I do not recognise.
Move all calls that use the secret to server code and read the secret from a server-only variable.
Remove it from Git history if it was committed (with my approval), and add checks that stop secrets from being committed.

Do not do this

Do not paste the new key into chat.
Do not wait to see if someone used it. Rotate first.

Try another entry