Exposed Shared Secret — rotation requested 2 weeks ago via developer@etsy.com, no resolution

[pistilbooksonline-web]

Confirmation

• I confirm this post does NOT contain sensitive data for my account.

Question / discussion

Hi, I'm hoping someone from the Etsy team can help or point me in the right direction.

I'm the owner of a registered Seller App, "Pistil Books" used only to manage my own shop's (Pistilbooks) inventory. My app's Shared Secret was accidentally exposed during local development.

I reported this to developer@etsy.com on 8/2 and asked for the Shared Secret to be rotated. A support rep confirmed it was escalated to a specialized team, but that was weeks ago, and despite two follow-up emails and a message to security@etsy.com, I haven't received a resolution or new credentials.

There doesn't appear to be a self-service way to regenerate a Shared Secret from the developer dashboard — is that correct? And is there anything else I can do to help move this along?

Thanks for any help.

[katietelford9796]

@pistilbooksonline-web did you ever get a resolution on this issue? i am running into same issue and no response from developer@etsy.com

[pistilbooksonline-web]

Yes, I did get a resolution and was given a new secret phrase. It took about three weeks, though, and I bugged them with multiple messages previous to their actually finally coming through. So I don't know what would have happened if I was not persistent.