While it sounds likely that they leaked their key, it is also not entirely fair to characterize it as user error. Why does stripe apparently issue keys that can

While it sounds likely that they leaked their key, it is also not entirely fair to characterize it as user error. Why does stripe apparently issue keys that can create new accounts, charge users, and withdraw money, and no one comments on this being abnormal? Setting up accounts should be a rare action (not something you need your application to be programmatically doing), and then they issue a scoped token that can e.g. charge your users and send the proceeds to one of those predefined accounts, refund transactions that it created, etc. and you give that to your application. Even if they have the ability to issue "do everything" tokens/keys, that should be something they hide on a corner of their UI with lots of warnings about why it's a bad idea and how scoped tokens are what you mean to use unless you really really know what you want. It shouldn't be something you accidentally walk into.