Deleted Google API keys keep working for up to 23 minutes, researchers warn

Google API keys are credentials that let applications access Google services, from Maps to the Gemini AI. If a key is leaked, an attacker can use it to make API calls, rack up charges, and, if Gemini is enabled, access uploaded files and cached conversations. The assumed fix is simple: delete the key. But Aikido Security has found that deletion doesn’t actually work right away. The testing The researcherd found successful authentications up to 23 … More →

The post Deleted Google API keys keep working for up to 23 minutes, researchers warn appeared first on Help Net Security.