Google API key detected
CriticalAV-SECRET-013Secrets & data exposureCore pack
What it finds
A google api key pattern (id: google_api_key).
Why it matters
A hardcoded credential of this type grants whoever has it that key's full authority until it is rotated.
How to fix it
Remove the value from source, rotate the credential immediately, and load it from an environment variable or secret manager.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- SECRET_DETECTED_GOOGLE_API_KEY
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Any text-based source, config, or environment file
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Hardcoded credentials (generic pattern)AV-SECRET-001 · Critical
- Credential or secret placed in the system promptAV-DATA-002 · High
- Data exfiltration path: private data + untrusted input + outbound channelAV-DATA-003 · High
- Credential stored in plain text in the MCP configAV-MCP-102 · High
- All environment variables handed to an MCP serverAV-MCP-111 · High
- Personal data sent to the model without redactionAV-DATA-004 · High