Severity: Low–Medium · Calibrated

Unrestricted Google Maps API Key on wing.com

A client-side key with no origin restrictions — documented with the minimum necessary proof.

About this page. This is a static case study. It makes no live API calls and the key is redacted. An earlier version ran a live loop firing thousands of real requests at the key; that has been removed, because a single cross-origin call already proves the point and volume abuse against a third party's key is neither necessary nor appropriate.

The finding

Target	`wing.com/get-delivery`
Source	client-side bundle (`zone.js`)
Key	`AIzaSy…[REDACTED]` — masked; reported to Google VRP
API surface	Google Maps (JS / Geocoding / Street View)
Restrictions	None observed (usable from any origin)
Class	Exposed credential / missing key restriction (CWE-200, CWE-284)

Proof (read-only)

One successful Geocoding request from an unrelated origin confirms the key is not referrer-restricted:

curl "https://maps.googleapis.com/maps/api/geocode/json?address=Dhaka&key=AIzaSy…[REDACTED]"

A valid 200 OK is sufficient. No looping or volume testing is required or appropriate.

Impact — stated plainly

An unrestricted, billable key can be reused from any origin, so a third party's usage is billed to the key owner and can consume its quota. It does not bypass authentication or expose user data. Impact is bounded by whether the key is enabled/billed and by Google's per-key quotas and abuse protections.

Recommended fix

Apply HTTP-referrer restrictions (limit to wing.com).
Restrict the key to only the APIs in use.
Rotate the key if unauthorized use is suspected.
Reference: Google — API key best practices.