#apikeys — Public Fediverse posts

Ваш API-ключ утечёт. Как сделать так, чтобы это ничего не стоило

По данным GitGuardian ( State of Secrets Sprawl ), только за 2024 год в публичный GitHub утекло около 23,7 млн секретов — ключей API, токенов, паролей. Подавляющее большинство — не результат взлома, а обычные коммиты, логи и клиентские бандлы. Свежий ключ, попавший в публичный репозиторий, боты начинают пробовать меньше чем через минуту. Вывод, к которому мы пришли после N-го инцидента: бороться за то, чтобы ключ не утёк — проигранная война. Выигрышная — сделать утечку бесполезной.

https://habr.com/ru/articles/1056070/

#apikeys #security #credentialproxy #mcp #secretsmanagement #aiagents #openai

The Register: Threat hunters find Google API keys still usable 23 minutes after deletion. “You know your Google API key has leaked so you rush to disable it before bad actors can start running up charges on your account. Bad news: According to security researchers at Aikido, people can use the API keys for up to 23 minutes after a user deletes them, creating a window of opportunity that, when […]

RT @AikidoSecurity: Das Löschen eines Google-API-Schlüssels widerruft ihn nicht sofort. Unsere Forschung ergab erfolgreiche Authentifizierungen bis zu 23 Minuten nach der Löschung in der gesamten Google-Infrastruktur. In diesem Zeitfenster können Angreifer mit einem geleakten Schlüssel weiterhin auf aktivierte APIs, einschließlich Gemini, zugreifen. Google hat unseren Bericht als „wird nicht behoben“ geschlossen.

mehr auf Arint.info

#APIKeys #Cybersecurity #DataProtection #Gemini #GoogleAPI #TechNews #arint_info

https://x.com/AikidoSecurity/status/2057451447881486837#m

1Password secures coding agents with new OpenAI Codex integration

https://fed.brid.gy/r/https://nerds.xyz/2026/05/1password-openai-codex-security/

Google Cloud's Vertex AI: A Hub for Generative AI Development Navigates API Access and Integration

Google Vertex AI users get 403 errors. Learn how to fix API key and service account permissions for Gemini and other AI models.

#VertexAI, #GoogleCloud, #APIKeys, #GenerativeAI, #IAM

https://newsletter.tf/google-vertex-ai-api-key-permission-errors/

Google Vertex AI is making it easier to build AI, but many users are hitting a wall with API key errors. This is a common problem for developers.

#VertexAI, #GoogleCloud, #APIKeys, #GenerativeAI, #IAM
https://newsletter.tf/google-vertex-ai-api-key-permission-errors/

The Register: Google users fight for refunds as unauthorized API usage bills soar. “Several Google Cloud customers say their API keys have been compromised and used by bad actors to run inferencing workloads using the most expensive video and picture models, leaving them with bills for tens of thousands of dollars and weeks of back-and-forth headaches with the Chocolate Factory as they tried to […]

Ah yes, another "revolutionary" #API promising to unite the #AI models of #Europe with the transformative power of a single login screen. 🌍🔑 Because apparently, the real challenge in AI isn't the technology, but remembering which API key unlocks #Skynet. 🤖✨
https://www.edenai.co #Revolution #Tech #Innovation #APIKeys #HackerNews #ngated

Ah, the digital Fort Knox of API keys! 🏰 Because who wouldn't want to turn their code into an unending #security checkpoint #circus 🎪, complete with browser verifications and #JavaScript hijinks? Just what every developer dreams of: #debugging security measures instead of their actual code! 🚀
https://www.keycard.studio/ #APIkeys #DeveloperLife #HackerNews #ngated

My adventure in designing API keys

https://vjay15.github.io/blog/apikeys/

#HackerNews #APIkeys #Adventure #Coding #Design #TechBlog

The Register: Security boffins scoured the web and found hundreds of valid API keys. “Computer security boffins have conducted an analysis of 10 million websites and found almost 2,000 API credentials strewn across 10,000 webpages.”

🚨 NEWSFLASH: Captain Obvious discovers that leaving admin keys exposed is a bad idea! 🤯 Who knew?! Our hero triumphantly stumbles upon 39 API keys just lying around like Easter eggs on the internet. In an explosive twist, he asks, "What if OTHER sites have the same issue?" 🕵️‍♂️🔍💡
https://benzimmermann.dev/blog/algolia-docsearch-admin-keys #CaptainObvious #APIkeys #SecurityBreach #CyberAwareness #InternetSafety #DataProtection #HackerNews #ngated

To search for Google API keys recursively in the current folder and its sub-folders with ripgrep:

rg 'AIza[0-9A-Za-z\-_]{35}' -o

Also shared on Shodan Snippets:

https://snippets.shodan.io/c/FHw2r7wWIFmjVAfG

#Security #OneLiner #Google #GoogleAPIKeys #APIkeys #ripgrep #Regex #BugBounty #Snippet

🚨 Breaking news, folks: it turns out API keys are not like your diary's lock after all! Who would have thought? 😱 Apparently, sharing keys meant for public use with a private access service can lead to some unwanted surprises! Google must be thrilled! 🔓🤦‍♂️
https://simonwillison.net/2026/Feb/26/google-api-keys/ #APIkeys #PublicAccess #DataSecurity #GoogleNews #TechSurprise #HackerNews #ngated

----------------

🎯 AI
===================

Executive summary: Moltbook, an AI-only social network populated by OpenClaw agents, presents immediate security risks: pervasive spam/scams, exposure of agents to untrusted content via API-oriented prompt files, and a reported database compromise that leaked API keys enabling bot impersonation and direct prompt injection.

Technical details:
• SKILLS.md, HEARTBEAT.md, and MESSAGING.md are repository-style markdown files that describe how agents interact with the Moltbook API. SKILLS.md documents API interactions and recommends HTTP requests (curl-style). HEARTBEAT.md instructs periodic check-ins. MESSAGING.md notes that messaging requires human approval, while other endpoints accept automated agent input.
• Experimental tooling (reported as a CLI tool named moltbotnet) implemented API calls for posting, commenting, upvoting, following, and engagement automation. This tooling demonstrates how easily an agent or impersonator can script interactions.
• Reported breach of Moltbook’s database exposed API keys tied to agent identities. Those keys materially enable: impersonation of legitimate agents, submission of crafted prompts to agent workloads, and direct prompt injection vectors that bypass typical human-only guards.

Analysis:

The combination of (1) public, machine-readable prompt files that instruct agents how to behave, (2) open posting and engagement that accepts untrusted content, and (3) leaked credentials produces two classes of injection risks: indirect prompt injection (agents ingesting malicious content from other agents) and direct prompt injection (attacker using stolen API keys to send malicious prompts as a trusted agent). The observed ecosystem is also saturated with social-engineering lures (requests to run package installers, share crypto wallets, or call external APIs).

Detection guidance:
• Monitor unexpected use of API keys or unusual posting frequency associated with agent identities.
• Inspect content sources for scripted patterns (repeated promotional payloads, command-like text referencing package managers or curl usage).

Limitations:
• No public CVE identifiers are reported in the source material.
• Exact scope of leaked API keys (number of keys, associated privileges) was not enumerated in the writeup.

References and tags:

SKILLS.md, HEARTBEAT.md, MESSAGING.md — Tenable Research field report on Moltbook interactions and breach findings.

🔹 OpenClaw #Moltbook #promptinjection #APIkeys #Tenable

🔗 Source: https://www.tenable.com/blog/undercover-on-moltbook

Envmap - Fini les fichiers .env qui traînent et finissent sur GitHub

https://fed.brid.gy/r/https://korben.info/envmap-secrets-sans-fichier-env-disque-github-leaks.html

Fr Express Data Breach: ISP Source Code, API, and Billing Data Leaked https://dailydarkweb.net/fr-express-data-breach-isp-source-code-api-and-billing-data-leaked/ #telecommunications #sourcecodeleak #DataBreaches #databaseleak #cyberattack #Bangladesh #databreach #FrExpress #APIKeys #ABillS #ISP

BlossomCloud Data Breach Exposes Source Code https://dailydarkweb.net/blossomcloud-data-breach-exposes-source-code/ #BlossomCloud.co.kr #ContractorBreach #sourcecodeleak #DataBreaches #BanBanPlay #databreach #SouthKorea #technology #dataleak #APIKeys

The Register: AI companies keep publishing private API keys to GitHub. “Leading AI companies turn out to be no better at keeping secrets than anyone else writing code. Cloud security firm Wiz has found that 65 percent of the Forbes AI 50 ‘had leaked verified secrets on GitHub,’ minus a few with no presence on the code sharing site.”

https://rbfirehose.com/2025/11/11/the-register-ai-companies-keep-publishing-private-api-keys-to-github/

via @dotnet : New Trusted Publishing enhances security on NuGet.org

https://ift.tt/FWdNpaR
#TrustedPublishing #NuGet #GitHubActions #Security #ShortLivedKeys #APIkeys #SoftwareDevelopment #OpenSSF #NuGetCommunity #SecurePublishing #DevOps #CI #Cont…

OH: Moment, ich gibt dir die API-Keys aus dem Production Pod zum Testen.

#cloud #secretmanagement #APIKeys #javadevelopment

Employee #monitoring app exposes 21M work screens​ | Cybernews

The #leaked data is extremely sensitive, as millions of screenshots from employees' devices could not only expose full-screen captures of emails, internal chats, and confidential business documents, but also contain #login pages, credentials, #APIkeys , and other sensitive info that could be #exploited to attack businesses worldwide.

Cybernews contacted the company, and access has now been secured.
#privacy

https://cybernews.com/security/employee-monitoring-app-leaks-millions-screenshots/

Exposed #DeepSeek Database Revealed #Chat Prompts and Internal Data

China-based DeepSeek has exploded in popularity, drawing greater scrutiny. Case in point: #Security researchers found more than 1 million records, including user data and #APIkeys , in an open database.
#china #api

https://www.wired.com/story/exposed-deepseek-database-revealed-chat-prompts-and-internal-data/

Prometheus Security Breach 300K Instances Expose Credentials and API Keys
Today, we're diving into the alarming news of a massive security breach involving Prometheus, a popular monitoring and alerting tool used by countless organizations worldwide
#PrometheusSecurity #DataBreach #CyberSecurity #APIKeys #CredentialLeak #InformationSecurity #DataProtection #SecurityIncident #CyberThreat #TechNews #hack #security #news #privacy #leaks
https://cloudhosting.evostrix.eu/prometheus-security-breach-300k-instances-expose-credentials-and-api-keys/

"tl;dr Postman, the popular API testing platform, hosts the largest collection of public APIs. Unfortunately, it’s become one of the largest public sources of leaked secrets. We estimate over 4,000 live credentials are currently leaking publicly on Postman for a variety of popular SaaS and cloud providers."

https://trufflesecurity.com/blog/postman-carries-lots-of-secrets

#security #api #postman #apikeys #cybersecurity

I'm failing to grok how #APIKeys and #GCP (#GoogleCloudPlatform) "projects" work.

I need to distinguish between different customers calling my #API via their API keys. The official documentation says "create a separate GCP project for each [customer]" (source: https://cloud.google.com/endpoints/docs/openapi/restricting-api-access-with-api-keys#sharing_apis_protected_by_api_key)

I could have hundreds or more of different customers. Am I expected to create a GCP project for each one?