A developer discovered that a major online gift retailer (1-800-Flowers) was exposing sensitive API keys directly in client-side JavaScript, including PayPal client IDs, Venmo profile IDs, Auth0 credentials, Visa Checkout API keys, and address verification tokens. The leak was visible to anyone who opened browser dev tools. The root cause appears to be developers bundling environment configuration into a React single-page application without distinguishing between public and private data, likely to support both web and mobile app deployments from a single build.
Sort: