Investigate Google API key (client-shipped; restriction unverified)

Build 0.649 · Scan 2026-10-07T07:23:59.794Z

1 distinct recorded findings; 1 have inspectable metadata. Locations are representative, not an inventory of every source match.

Android apps are designed to ship Google API keys in the client; Google restricts them by app signing certificate + enabled API. This is only a problem if the key is left unrestricted — presence alone is expected, not an exposure.

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

assets/www/scripts/IWE.MainFlow.LiveTrackingPackage.mvc.js

Recorded match

AIza•••••••• (21–40 chars, redacted)

Detector rule

google_api_key

Recorded file locations

assets/www/scripts/IWE.MainFlow.LiveTrackingPackage.mvc.js
assets/www/scripts/IWE.MainFlow.NewOrderCharity.mvc.js
assets/www/scripts/IWE.controller.js
assets/www/scripts/IWE.MainFlow.NewOrderWithUber.mvc.js
assets/www/scripts/IWE.MainFlow.NewLocations.mvc.js
assets/www/scripts/IWE.Common.CreateAccountOld.mvc.js
assets/www/scripts/IWE.MainFlow.CompleteRegistration.mvc.js
assets/www/scripts/IWE.MainFlow.Account.mvc.js