DasMammutMar 10

Warnung zu #GoogleApiKeys - #Gemini for free 🤯

Ich bekomme von der #GMDS gerade eine Warnung, dass Google API Keys (z.B. für Google Maps auf Webseiten) oft im Quellcode (HTML-Datei) im Klartext gespeichert werden. Damit lassen sich aber auch kostenpflichtige Dienste wie #Gemini nutzen, was dann dem Inhaber der API-Keys in Rechnung gestellt wird. Also Obacht !

SkypLabsMar 2

To search for Google API keys recursively in the current folder and its sub-folders with ripgrep:

rg 'AIza[0-9A-Za-z\-_]{35}' -o

Also shared on Shodan Snippets:

https://snippets.shodan.io/c/FHw2r7wWIFmjVAfG

#Security #OneLiner #Google #GoogleAPIKeys #APIkeys #ripgrep #Regex #BugBounty #Snippet

Shodan Snippets

Harry SintonenFeb 26

Retroactively changing the role of a token or key is a very bad idea.

https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

#google #googleapikeys #infosec #cybersecurity

Google API Keys Weren't Secrets. But then Gemini Changed the Rules. ◆ Truffle Security Co.

Google spent over a decade telling developers that Google API keys (like those used in Maps, Firebase, etc.) are not secrets. But that's no longer true.

Hacker NewsFeb 26

Google API Keys Weren't Secrets. But Then Gemini Changed the Rules

https://simonwillison.net/2026/Feb/26/google-api-keys/

#HackerNews #GoogleAPIKeys #Gemini #Changes #TechNews #SecurityUpdates

Google API Keys Weren’t Secrets. But then Gemini Changed the Rules.

Yikes! It turns out Gemini and Google Maps (and other services) share the same API keys... but Google Maps API keys are designed to be public, since they are embedded …

Simon Willison’s Weblog
Hacker NewsFeb 26

Google API keys weren't secrets, but then Gemini changed the rules

https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

#HackerNews #GoogleAPIKeys #GeminiRules #SecurityTech #DeveloperNews

Google API Keys Weren't Secrets. But then Gemini Changed the Rules. ◆ Truffle Security Co.

Google spent over a decade telling developers that Google API keys (like those used in Maps, Firebase, etc.) are not secrets. But that's no longer true.