I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to:


I also found their Google API key value inside that javascript file. I was able to access their personal CSE Google API. Is this something I should report to the company? I'm not sure if this could count as a valid issue or not.


There is potentially really an issue here, but it is unlikely. Including their Google API key value inside JavaScript is how it is done. Yes you can bypass their search function and query the Google API directly, but to what end? The API will have its own validation that will limit what you can do. Are you able to gain more info than what was already available to you on the website? If so, then it is an "information Disclosure" vulnerability, if not then is it really a vulnerability?

  • Does it make any difference if, with their api key, i also found their google api backup key? – stack ups Apr 18 at 14:23

Your Answer

