Reproduction steps:
- Log in as a seller.
- Settings → Publisher / Payouts.
- The "Connect Stripe" area (automatic payouts not connected) renders a raw
Stripe API error by default. Nothing is probed or exploited — it is shown
as-is on page load.
Expected:
A failed Stripe Connect call should surface a generic, seller-safe message
(e.g. "automatic payouts aren't set up yet — contact support"). No internal
payment-infra identifiers should reach the client.
Actual:
The UI forwards Stripe's raw error body verbatim. It exposes, to every seller:
- the platform Stripe account id (acct_1Tj0gG…)
- the restricted key id (mk_1TwiMh…)
- a partial restricted key (rk_live_…DpeI)
- a deep link to your own Stripe dashboard to edit that key
- the missing-permission hint: the key lacks connected_account_write
The rk_live_ value is truncated (not directly usable), but the account/key ids,
the dashboard URL, and the "which permission is missing" hint should never be
sent to end users. It also reveals a Connect-key misconfiguration.
Suggested fix:
- Catch Stripe API errors server-side; return a generic client message. Never
forward Stripe's raw error body (it carries account/key ids + dashboard URLs).
- Resolve the underlying Connect-key permission (connected_account_write) so the
path stops erroring.
Found during normal use (opening the Payouts tab) — no probing.