Investigate Google API key (client-shipped; restriction unverified)

Build 10.70.0 · Scan 2026-10-04T18:31:55.134Z

35 distinct recorded findings; 35 have inspectable metadata. Locations are representative, not an inventory of every source match.

Android apps are designed to ship Google API keys in the client; Google restricts them by app signing certificate + enabled API. This is only a problem if the key is left unrestricted — presence alone is expected, not an exposure.

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

lib/armeabi-v7a/libapp.so

Recorded match

AIza•••••••• (21–40 chars, redacted)

Detector rule

google_api_key

Recorded file locations

lib/armeabi-v7a/libapp.so
lib/x86_64/libapp.so
lib/arm64-v8a/libapp.so