1Password - Enterprise Password Manager · Report #2923061
API Key Exposed in JavaScript File on 1Password Developer Site
Summary
The researcher reported an API key exposed within a JavaScript file on our public developer documentation site (developer.1password.com). This key is intentionally embedded to enable Algolia-powered search functionality. It is a public, client-side key with strictly limited permissions and does not grant access to any sensitive data or privileged actions.
This behavior is expected and aligns with Algolia’s recommended integration practices for public-facing search implementations.
Additionally, developer.1password.com is an asset that is explicitly out of scope for our bug bounty program. We encourage all researchers to review our program brief carefully before submitting reports to ensure focus on in-scope targets and high-impact findings.
Based on these factors, the report was closed as Not Applicable.
How it was found
An API key has been exposed in the JavaScript file accessible via the public developer documentation for 1Password. This exposure could potentially allow unauthorized access to APIs or services that rely on this key, leading to a range of security issues, including data leakage or unauthorized actions within the affected system.
Steps To Reproduce:
- Visit the following URL: https://developer.1password.com/assets/js/main.43f8ae7b.js
- Inspect the contents of the file.
- Locate the exposed API key (in plain text) embedded within the JavaScript code.
- Confirm the key's accessibility without any authentication or restriction.
Supporting Material/References: Direct link to the exposed file: https://developer.1password.com/assets/js/main.43f8ae7b.js
Impact
An attacker can potentially use the exposed API key to:
- Access or manipulate sensitive data from the service it is associated with.
- Perform unauthorized actions or requests, potentially leading to data breaches or service disruption.
- Cause reputational damage if the exposed key is linked to critical resources.