Spaces:

---

protocol-jarvis

/

Jarvis_protocol

like 1

Running

Summary:
A valid, active Google API key was found hardcoded in a public Hugging Face Space. The key was created on 2026-04-13 and is currently usable.

Steps to Reproduce:

1. Visit the Space: https://huggingface.co/spaces/protocol-jarvis/Jarvis_protocol
2. View the file: index.html
3. The key appears as: AIzaSyAjGP... (full key withheld)

Impact:
An attacker could use this key to:

• Incur significant API costs on your account
• Access any associated data or services
• Potentially pivot to internal resources if the key has broad permissions

Recommendation:

• Immediately revoke the exposed key via your [provider] dashboard
• Use Hugging Face Secrets (environment variables) instead of hardcoding
• Rotate any other keys that may share the same pattern

Proof of Concept (Safe):
I validated the key using the provider's free /models endpoint, which confirmed it is active. No paid API calls were made.

Disclosure:
I am a 16yr old bug hunter reporting this in good faith. I have not shared or abused this key. Am saving to buy a new pc.

Request:
Does your organization have a bug bounty program? I would like to submit this for consideration and have a great day.