Investigate Mailgun API key

Build 4.101.3 · Scan 2026-10-08T06:30:50.226Z

1 distinct recorded findings; 1 have inspectable metadata. Locations are representative, not an inventory of every source match.

A Mailgun API key. If active it can send email as the developer's domain — a phishing and deliverability risk until rotated.

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

assets/index.android.bundle

Recorded match

•••••••• (21–40 chars, redacted)

Detector rule

mailgun_key

Recorded file locations