Story
Google API keys weren't secrets, but then Gemini changed the rules
1 report
1 website
1 discussion
Latest report
Overview
Google API keys, previously considered non-sensitive, can now be used by Gemini to access private user data. A scan of millions of websites revealed nearly 3,000 Google API keys that were originally deployed for public services.
Summary from trufflesecurity.com.
Reports
One report so far. Additional coverage will appear here when it is linked to this story.
Community reactions
Each reaction summarizes sampled comments from the linked discussion.
Hacker News · trufflesecurity.com
Hacker News discussion ↗
Historical count: 5 · 5 saved in sample · Historical sample
Analysis ready
Read this discussion’s reaction
Based on 5 sampled comments from this thread. Analyzed 2026-02-26.
- Concern: Google's failure to standardize tests or specifications for API key security highlights a significant oversight, raising concerns about their commitment to user safety.
- Concern: The retroactive privilege expansion of API keys without user notification poses serious risks, allowing unauthorized access to sensitive data and potentially leading to unexpected costs.
- Concern: Allowing older, public keys to access the Gemini API without adequate safeguards demonstrates a lack of foresight in API security management, which could undermine trust in their services.