Investigate Google API key (client-shipped; restriction unverified)
Build 10.85.5 · Scan 2026-10-11T06:48:14.843Z
5 distinct recorded findings; 5 have inspectable metadata. Locations are representative, not an inventory of every source match.
Android apps are designed to ship Google API keys in the client; Google restricts them by app signing certificate + enabled API. This is only a problem if the key is left unrestricted — presence alone is expected, not an exposure.
Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.
Evidence preview
- Evidence type
- Static string match
- Representative location
resources.arsc- Recorded match
AIza•••••••• (21–40 chars, redacted)- Detector rule
google_api_key- Recorded file locations
resources.arscreleasenossl/google-services.jsonperformance/google-services.jsonlaunchtime/google-services.jsonrelease/google-services.jsonpaytm/benchmarkPerformance/google-services.jsonpaytm/nonMinifiedRelease/google-services.jsonpaytm/nonMinifiedPerformance/google-services.json