A Google API key is not always just a Low or Informational finding. The Story of Submitting some P1s in the last months by the same method Sometimes the real impact is in what you can do with it. For example, with Firebase / Google Identity Toolkit, a leaked key may allow account creation directly through the API: curl -sk -X POST \ "identitytoolkit.googleapis.c…" \ -H "Content-Type: application/json" \ -d '{"email":"youremail@company.com","password":"Test12345!","returnSecureToken":true}' Now imagine the application trusts users based on the email domain and does not properly verify ownership. In that case, you may be able to create an account using an organization email, receive a valid auth token, and access parts of the application that were supposed to be limited to internal users. At that point, this is no longer about an "exposed Google API key". The impact can become unauthorized registration, authentication bypass, internal access, sensitive data exposure, or even full access to the application depending on how the backend handles authorization. So before marking a Google API key as Low, always check what the key actually allows you to do. The key itself may be Low. The impact behind it may not be. #bugbountytips #bugbountytip #infosec #Bugbounty