google-api-key· GoogleGoogle API key
Firebase web keys are public by design. Confirm the key has referrer restrictions and that Firebase Security Rules are set.
This is not a leak
KeyDrift matches this format on purpose, and then excludes it from the finding count. Recognising it is what makes the rest of the report trustworthy — a scanner that cannot tell this apart from a secret will either flag it and cry wolf, or stay quiet about the secret sitting next to it.
How it is detected
Matches the `AIza` prefix and reports it as a public credential. Firebase web configs are designed to ship this to the browser — access is controlled by Firebase Security Rules and key referrer restrictions, not by keeping the string secret, and Google’s own documentation publishes one. Reporting it as a leak is the most common false positive in off-the-shelf secret scanners.
What to do
- 1Nothing to rotate. This credential is designed to be public.
Where it turns up
Most often in client bundles built by AI coding tools.