Investigate Google API key (client-shipped; restriction unverified)

Build 26.16 · Scan 2026-10-09T11:35:11.637Z

3 distinct recorded findings; 3 have inspectable metadata. Locations are representative, not an inventory of every source match.

Android apps are designed to ship Google API keys in the client; Google restricts them by app signing certificate + enabled API. This is only a problem if the key is left unrestricted — presence alone is expected, not an exposure.

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

classes5.dex

Recorded match

AIza•••••••• (21–40 chars, redacted)

Detector rule

google_api_key

Recorded file locations

classes5.dex
classes11.dex