Monitoring finding · EXC-003
PayGate security incident — payout API keys not fully rotated
Control VEN-03PayGate Payment GatewayDetected 9 Oct 2026Severity critical
VEN-03 · monitored control
Supplier security incidents are assessed for impact and tracked
PayGate security incident — payout API keys not fully rotated
automated test
- Reasoning
- After PayGate incident PG-SEC-2026-014, 2 of 3 Meridian API credentials were rotated. The settlement-report API key (created 2025-11-02) is still active.
- expected
- All PayGate credentials created after 2026-10-03
- observed
- 1 credential predates incident
- Action / owner
- ○ No data available
None
No review signal applies to this finding.