HexBrain

8x8 · Report #3250315

█.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid Services

Validstatus
mediumseverity
$500bounty
88upvotes
14 Aug 2025disclosed

Summary

We resolved an issue where a Google Maps API key allowed potential unauthorized access to some Google Maps services. While the API key was intentionally included in client-side code, it lacked proper restrictions to prevent abuse of paid services. The potential impact could theoretically lead to API quota consumption and related billing concerns, though actual impact was limited as no evidence of exploitation was found. Our team promptly validated and addressed the report by implementing appropriate API key restrictions where feasible, while accepting other known limitations.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original