Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 39 Algolia admin keys exposed across open source documentation sites

benzimmermann.dev

Post reply on HN
Print view View original

21–30 of 62 posts

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#21

Post by netsharc »

binarymax wrote: post #13
netsharc wrote: post #9

Man, talk about unnecessary graphs... ok graph 2 is maybe tolerable, although it's showing the popularity of the projects, not a metric of how many errors/vulnerabilities found in those projects. I'm not a newspaper editor, but I think if this was an article for one, they'd also say the graphs are unnecessary. It smells of "I need some visual stuff to make this text interesting"...

Dude there’s only three graphs in there. Do they really bother you that much? The third may be a bit unnecessary but I think the visuals add to the post.

[flagged]

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#22

Post by integralid »

netsharc wrote: post #21
binarymax wrote: post #13

Earlier quoted context omitted.

Dude there’s only three graphs in there. Do they really bother you that much? The third may be a bit unnecessary but I think the visuals add to the post.

[flagged]

I liked the graphs. When skimming posts i often stop on graphical elements and decide if I want to understand the context or continue skimming. In this context, all three graphs were useful for me.

Posts with just text are sense and just not nice to read. That's why even text-only blog posts have a tendency to include loosely-related image at the top, to catch reader's eye.

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#24

Post by [deleted] »

integralid wrote: post #22
netsharc wrote: post #21

Earlier quoted context omitted.

[flagged]

I liked the graphs. When skimming posts i often stop on graphical elements and decide if I want to understand the context or continue skimming. In this context, all three graphs were useful for me. Posts with just text are sense and just not nice to read. That's why even text-only blog posts have a tendency to include loosely-related image at the top, to catch reader's eye.

[deleted]

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#25

Post by TurdF3rguson »

richbell wrote: post #18
TurdF3rguson wrote: post #15

Earlier quoted context omitted.

I'm not following this at all. It seems like OP is saying if you share a secret in your (private?) gist and give Algolia permission to read the gist, they will invalidate it. But why would the secret be in a gist and not a repo? Also if you're aware enough to add that partner it seems you're aware to not do dumb things like that in the first place.

If you find an exposed token in the wild, for a service supported by GitHub Secret Scanning, uploading it to a Gist will either immediately revoke it or notify the owner.

Ok I see, so any public gist with an algolia key in it will get invalidated? And it would have to follow some pattern like ALGOLIA_KEY=xxx ?

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#26

Post by system2 »

_pdp_ wrote: post #23
TechSquidTV wrote: post #20

I have been developing an OpenClaw-like agent that automates exactly this type of attack.

Why? This is just regex search and there are plenty of tools that do this perfectly fine.

None of those proven tools would make a man feel like a wannabe Mr. Robot.

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#27

Post by shermantanktop »

netsharc wrote: post #21
binarymax wrote: post #13

Earlier quoted context omitted.

Dude there’s only three graphs in there. Do they really bother you that much? The third may be a bit unnecessary but I think the visuals add to the post.

[flagged]

If you’re “helping a kid” then I guess I can help you. Help is criticism delivered with a constructive tone. Criticism can be helpful if you look past the tone.

If you want to help, you should sound helpful.

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#28

Post by tcbrah »

the wildest part is algolia just not responding. you email them saying "hey 39 of your customers have admin keys in their frontend" and they ghost you? thats way worse than the keys themselves imo. like the whole point of docsearch is they manage the crawling FOR you, but then the "run your own crawler" docs basically hand you a footgun with zero guardrails. they could just... not issue admin-scoped keys through that flow

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#30

Post by emotiveengine »

_pdp_ wrote: post #23
TechSquidTV wrote: post #20

I have been developing an OpenClaw-like agent that automates exactly this type of attack.

Why? This is just regex search and there are plenty of tools that do this perfectly fine.

Have to agree with _pdp_ on this one. I just don't see the need for an LLM agent to do a recursive grep for API keys in public repos.

Not saying people shouldn't build these tools, but the use case is lost on me.

It feels like the industry is in this weird phase of trying to replace 30-year-old, perfectly optimized shell utilities with multi-shot agent workflows that literally cost money to run. A basic Python script with a regex matcher and the GitHub API will find these keys faster, cheaper, and more reliably.

Post reply on HN