2 ms·

The article calls out to a Reddit post [0] in which OP admits that their app code or environment has been compromised and doubles down on stripe in it. [0] htt

• qingcharles 2y ago
  It does look a little more nuanced, seemingly with Stripe allowing all sorts of actions that should have been restricted even with access the API key: https://www.reddit.com/r/stripe/comments/1itn3i7/comment/me18vrp/ https://www.reddit.com/r/stripe/comments/1itn3i7/comment/me1... Truth often lies somewhere in the middle.
• Sayrus 2y ago
  Had the exact same happen to a relative of mine. Their API key was compromised, Express Account were added with a bank account in Greece rather than the existing in France, these account didn't require any verification unlike accounts he added in the past, existing credits cards were billed hundreds of thousands when the entire account had not even half of that over years. Overall it's his fault for not properly securing the API key, but Stripe should have suspended the account when over 90% of the payments were failed charges and money was being moved to another country.