Two credential classes in one application
One assessment, start to finish, with nothing in it that identifies the application or its owner.
Scope. What was tested, what was not, and why
The assessment began with a written scope: anonymous public surface only, no account creation, no authentication, no writes, one week. The owner's data and the owner's users were out of bounds, which meant every conclusion had to be reachable without touching either.
What the public bundle gives away
The application's client bundle is served publicly and contains more than interface code. It names the backend functions the front end calls and the entities it expects, which turns an unknown application into a map of reachable surface.
Two credential classes
Two categories of live credential were present in files served to any visitor. The first was a live service-account credential, which is a category that normally implies reach beyond the application that serves it. The second was a model-provider API key with active quota. Neither required an exploit to find; both were in the payload of a normal page load.
What I did not do
No call was made with either credential beyond the minimum needed to establish that it was live rather than a retired value. No data was read through them, nothing was listed, nothing was written, and no third party was contacted. Proving liveness and using access are different acts and only the first was in scope.
The report
The report named the two credential classes, the host and file that served each, the exact request that retrieves them, and the smallest next step that closes both: rotation, then a check of whether the same build pattern appears in sibling applications. Two credential classes were then reported to the platform operator on 6 November 2026.
What it cost to get this wrong
The first version of this finding was going to count exposed applications by status code. It would have been wrong by a factor that flattered the result. Measuring what the host actually returns, rather than that it returned something, is the difference between a finding and a story. The measurement method behind that correction is documented in Research.