An API key in the page source: everyone who opened the site can see it

A map, a chat widget, lead delivery, an account area. A developer puts a key in a page script because "that is how the example worked". The key arrives to every visitor. Nobody has to "hack" it. Opening the page is enough. Then someone else's script calls the API on your quota, and the bill comes to you.

Some keys are meant for this: a public map key limited to a domain. The trouble starts when a secret key sits next to it, with the right to read leads or change orders. A "only from our domain" limit in the browser is easy to walk around. The real limit lives on the server: what this key may do, and from which address the server accepts a request at all.

How to check without heroics

• Open the homepage and the account area as a normal visitor and look in the code for key, token, secret.
• Separate public keys from keys that can read data. Move the second kind off the client.
• After removal, issue a new secret. The old one that already went to a browser counts as known.
• Look at the service bill and limits: unusual spend often comes before a customer complaint.

This is a typical finding of both an audit and a pentest. An audit sees that a secret is exposed. A pentest is needed when that key also opens other people's orders. Lexora starts with the free basic audit for new clients and does not inflate the quote if it is enough to remove the key and rotate it. If the API is large and has roles, a website pentest is quoted separately, from $50 per endpoint.