Google API key in the client
Scan rule · RSC-SEC-029
- Security
- Severity: Medium
- CWE-1188
Records keys in `AIza…` format in shipped code — expected for Maps and Firebase, risky without a domain restriction.
Why this matters
Google browser keys belong in the frontend — Maps and Firebase do not work without them. Finding one is therefore not a leak, and we deliberately do not report it as a secret.
The risk lies in the restriction. An unrestricted key can be reused from any foreign site, and the project owner gets the bill. For Maps APIs that is a real cost exposure that only surfaces on the invoice.
The restriction is not verifiable from outside, so this is a prompt rather than a verdict: in the Google Cloud console set “Application restrictions” to HTTP referrers and narrow the API selection to what you actually use.
Scan tier
- External scan (anonymous)
How to fix it
Restrict the key in the Google Cloud console to your own domain (HTTP referrer) and the APIs you need.