8x8 · Report #3250315
█.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid Services
Summary
We resolved an issue where a Google Maps API key allowed potential unauthorized access to some Google Maps services. While the API key was intentionally included in client-side code, it lacked proper restrictions to prevent abuse of paid services. The potential impact could theoretically lead to API quota consumption and related billing concerns, though actual impact was limited as no evidence of exploitation was found. Our team promptly validated and addressed the report by implementing appropriate API key restrictions where feasible, while accepting other known limitations.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.