Zenly · Report #1093667
Google Maps API key stored as plain text leading to DOS and financial damage
Validstatus
mediumseverity
$750bounty
51upvotes
29 Jun 2021disclosed
Summary
The researcher highlighted the fact that the Google Maps API key (which is by design easily retrievable from the .apk) was missing some restrictions. It then could be used by anyone to query the Google Static Map API, and possibly lead to financial damage. Resolved by enforcing missing restrictions.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.