No vulnerability class is needed for the collection step. A scanner issues GET /.env against a host list and reads the response body. If the document root serves dotfiles, that body is key=value text, and one of the values begins with sk_live_. Scanners for /.env, /.git/HEAD and /debug predate this dump and are fully automated [18], which is the working hypothesis the dev.to writeup of Hudson Rock's Infostealers analysis lands on [6].
What the finder then holds is the interface the vendor's own backend holds. Depending on scope, a standard sk_live will service GET /v1/customers, GET /v1/charges and GET /v1/invoices/:id; with charge capability it accepts POST /v1/refunds; if account-settings write is allowed, POST /v1/payouts [10]. The JSON samples in the archive carry explicit charge-access flags, so the read-only reading of these keys does not survive contact with the file [9]. Every one of those calls is a documented Stripe API call. Stripe itself was not broken [11].
Two numbers are worth doing by hand. 1,033 keys across 669 vendors is 1.54 keys per vendor [1], so the average victim exposed more than the single key its checkout path uses. And the delivered archive of 2.37 GB against 33 GB advertised is 7.2% of the volume on offer [2], while the 1,033 counted keys are 5.2% of the actor's claimed 20,000 [3]. The first ratio speaks to deployment habits; the second reflects what a seller says while holding stock.
The server-side fix is a config line, not a project. In nginx, `location ~ /\. { deny all; }` has to be declared before any try_files, or the framework front controller gets the request first [13]. Apache does it with FilesMatch on `^\.env` plus RedirectMatch 404 on /\.git [13]. In Docker, .env belongs in .dockerignore and secrets belong in BuildKit `--mount=type=secret` rather than a COPY into the image [14]. The five-minute audit is a curl loop over /.env, /.env.example, /.git/HEAD and /debug expecting 403 or 404, with the one deliberate exception that /.well-known/security.txt should return 200 under RFC 9116 [12].
Order of operations decides whether any of that helps. Blocking the path closes the exposure; only rolling the key invalidates the copy already taken, via Developers, then API keys, then Roll secret key, then Revoke previous value [16]. After rotation, GET /v1/restricted_keys lists what exists and with which scopes, and the useful question is whether a service that needs payment_intents:write and customers:read was ever handed a standard key with refund and payout reach [17]. That audit is the durable part; the dotfile rule is only the piece you can ship before lunch.
