Google API key vulnerability | Bug Bounty

A Google API key vulnerability arises when an API key is exposed publicly (e.g., in code repositories or client-side scripts), allowing unauthorized users to misuse it.

Impact:

Unauthorized API Usage: Attackers can access and exploit APIs at the owner's expense.
Quota Exhaustion: Legitimate users are blocked as the usage quota is exceeded.
Data Exposure: Access to sensitive data through APIs like Maps, Drive, or Cloud services.
Financial Loss: Accrued costs from malicious or excessive API calls.
Mitigation: Restrict API keys to specific IPs, referrers, or services, and never expose them in public repositories.