Can we talk about how I missed a basic API key leak for 3 years

I run a small SaaS out of Austin and I always thought I had things locked down. Last month a security scan from a client flagged one of our endpoints, and I found a hardcoded API key in a public GitHub repo from 2021. The scary part is that key had admin scope on our billing API, and nobody noticed because our logs didn't track which key was being used. Has anyone else had a moment where a simple audit would've saved you months of risk?

1 comments

1 Comment

julia_patel25d ago

and honestly that's the part people don't talk about enough, the logging gap. Like yeah the key being out there is bad, but if you'd had any visibility into which key hit the billing API you would've caught it in like a day. I had a similar thing happen with an internal tool where we just never logged the user ID on a delete endpoint, so when someone scraped it we had zero idea who did it or when. The fix was simple too, just add the key hash to the log line, but nobody thinks about it until something already went sideways. That's the real lesson for me, it's not about being perfect at securing stuff, it's about being able to trace what happened when you mess up. You basically got lucky that the client's scan even found it, otherwise that key could've been used for years without anyone knowing.