Using xpub key derivation for user account balance?

Question

I want to accept payments, and to keep the wallet secure I believe using a xpub key would be the correct solution. The site uses Google Login, which gives me a user id.

My idea is that given the xpub on the server code, I can derive a unique payment address per user (using the Google user as the derivation seed), and then simply check the blockchain for new transactions. I would store the amount of used balance used on the server database, but since there are no physical products being sold, that shouldn't be of concern if hacked.

My question is if this would be secure, in case the server got hacked? If an hacker obtains the xpub and perhaps even some of the previously generated key derivations, is there anything bad the hacker could do?

(PS: Although I'm familiar with BTC inner-workings, this is my first project/implementation)

Answer 1

xpub is short for Extended Public Keys. Public keys, as their name suggests, are meant to be public. If the xpub is stolen, then all that will happen is that the thief will know how much money you have and public keys associated with those coins. All you lose is your privacy, no money is at risk.