Google API key in the client

Google browser keys belong in the frontend — Maps and Firebase do not work without them. Finding one is therefore not a leak, and we deliberately do not report it as a secret.

The risk lies in the restriction. An unrestricted key can be reused from any foreign site, and the project owner gets the bill. For Maps APIs that is a real cost exposure that only surfaces on the invoice.

The restriction is not verifiable from outside, so this is a prompt rather than a verdict: in the Google Cloud console set “Application restrictions” to HTTP referrers and narrow the API selection to what you actually use.