Home / Technology / API Keys Exposed: Secret Access to Critical Systems
API Keys Exposed: Secret Access to Critical Systems
2 Apr
Summary
- Thousands of API credentials, including for cloud and payment services, were found openly exposed.
- Exposed credentials were most often found within JavaScript files on public webpages.
- Sensitive data remained accessible for months or years, highlighting weak security monitoring.
Sensitive API credentials, including those for cloud platforms and payment services, are being openly exposed on thousands of public webpages, according to researchers. A study analyzing 10 million webpages identified 1,748 valid credentials across nearly 10,000 pages, with many linked to high-profile organizations. These credentials enable automated access to systems such as databases and storage, functioning differently from standard login details.
The majority of these exposures, approximately 84%, were found within JavaScript files, often included through build tools like Webpack. This indicates a systemic issue in how web assets are prepared and deployed, rather than isolated errors. Other exposed data appeared in HTML, JSON, and even CSS files, highlighting the pervasive nature of the problem across different development stages.
These exposed credentials often remained accessible for months or even years, revealing a critical lack of monitoring and review processes among developers. Following initial disclosure efforts, the number of exposed credentials saw a significant reduction within two weeks, suggesting that awareness and remediation are possible. However, researchers caution that their findings represent a minimum, with potentially far more credentials still undiscovered online.
