TLDR Tech / Dev
Google API Keys Weren't Secrets. But then Gemini Changed the Rules
Google API keys have been treated as benign public identifiers safe for client-side embedding, but have retroactively gained sensitive authentication privileges with the introduction of Gemini. When the Generative Language API is enabled on a Google Cloud project, existing public API keys can silently access private Gemini data like uploaded files, cached content, and incur usage charges. This vulnerability allows attackers to scrape public websites for keys and exploit them to access data or exhaust quotas secretly.
Read the full story