costexposure-public-key

Public API key exposed — verify vendor restrictions

CWE-798 — MITRE entryA02:2021 — Cryptographic FailuresOWASP ASVS V14.3.2CVSS v3.1v 2026-04-22

Authoritative references

cloud.google.com
/docs/authentication/api-keys#restricting_keys
developer.mapbox.com
/docs/accounts/guides/securing-mapbox-tokens
cwe.mitre.org
/data/definitions/798.html

Sekrd runs this check automatically on every scan that covers web application surface. Findings link back to this page so reviewers can validate the rule against the cited standards.

Disagree with how this rule fires on your site? Open a dispute from the finding card in your scan report — we review every ticket.

Public API key exposed — verify vendor restrictions

Authoritative references

Connect