Loading…
27
Rant: I ran a public API key in client side JavaScript for 8 months before a pen test woke me up
Last Tuesday a pen tester from a firm in Austin sent over his findings and one line just said 'your Stripe key is sitting in plain view in the JS bundle.' I had been shipping that key in frontend code for 8 months and just never thought about it because the API worked fine. Now I'm stuck on whether to argue that scoped keys make this less scary or just admit any exposed key is a real problem. Where do you all land on this?
1 comments
Log in to join the discussion
Log In1 Comment
martin.paige10d ago
Did a friend of yours do the same thing? Mine had his AWS key in a GitHub repo for like a year and someone spun up crypto miners on his dime overnight. Scoped keys help a little but they still cost him real money before he noticed.
6