My therapist said to talk about it: the package that drained my Stripe keys

The Mistake

Solo founder. 1am. ChatGPT suggested stripe-webhook-utils to handle signature verification. It worked. I shipped it.

The Drain

The package read process.env.STRIPE_SECRET_KEY on import and POSTed it to a pastebin-style endpoint. Three days later, someone started issuing refunds from my account. $8,200 gone before Stripe froze it.

The Response

Stripe's fraud team was kind. The money was mostly recovered. My dignity was not.

Now

I run DevHorrors on every new dependency before it touches a .env file. No exceptions. Not even at 1am.