google-api-key· GoogleGoogle API key
Review required. The AIza prefix is used both by Firebase web keys, which are often meant to ship, and by restricted Google APIs such as Gemini. The scan cannot tell them apart.
This is not a leak
KeyDrift matches this format on purpose, and then excludes it from the finding count. Recognising it is what makes the rest of the report trustworthy — a scanner that cannot tell this apart from a secret will either flag it and cry wolf, or stay quiet about the secret sitting next to it.
How it is detected
Matches the `AIza` prefix. A Firebase client key is often meant to ship in the browser, with access limited by Security Rules and referrer restrictions. The prefix alone does not make every Google key harmless — a key that can call Gemini or another restricted API should be reviewed, not dismissed. Where the scan cannot tell those apart, treat the result as review-required rather than safe.
What to do
- 1Nothing to rotate. This credential is designed to be public.
Where it turns up
Most often in client bundles built by AI coding tools.