{"id":60388,"date":"2026-03-27T07:04:15","date_gmt":"2026-03-27T07:04:15","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/security-boffins-scoured-the-web-and-found-hundreds-of-valid-api-keys\/"},"modified":"2026-03-27T07:04:15","modified_gmt":"2026-03-27T07:04:15","slug":"security-boffins-scoured-the-web-and-found-hundreds-of-valid-api-keys","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/security-boffins-scoured-the-web-and-found-hundreds-of-valid-api-keys\/","title":{"rendered":"Security boffins scoured the web and found hundreds of valid API keys"},"content":{"rendered":"

Computer security boffins have conducted an analysis of 10 million websites and found almost 2,000 API credentials strewn across 10,000 webpages.<\/p>\n

The researchers detail their findings in a preprint paper<\/a> titled “Keys on Doormats: Exposed API Credentials on the Web,” and say they conducted the study because much of the attention on exposed credentials has focused on scouring code repositories and source code. They argue that dynamic analysis of production websites is essential to understand the scope of the problem.<\/p>\n

“What we found were highly sensitive API credentials left publicly exposed on public webpages,” Nurullah Demir, a PhD candidate at Stanford and corresponding author, told The Register<\/em> in an email. “These act as access tokens that authorize applications to interact with third-party services, granting direct access to critical infrastructure like cloud platforms and payment providers.”<\/p>\n