[flagged]
I found 39 Algolia admin keys exposed across open source documentation sites
31–40 of 62 posts
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#32[dead]
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#33Earlier quoted context omitted.
[flagged]
If you’re “helping a kid” then I guess I can help you. Help is criticism delivered with a constructive tone. Criticism can be helpful if you look past the tone. If you want to help, you should sound helpful.
Fully agreed; this is something that always baffles me when it's misunderstood so often. Regardless of whether it's logical or not, tone and attitude in practice does influence whether people are convinced by something, so if your goal is to actually change how someone else acts, you will not be as effective if you don't care about how you come across. Being right is not always enough, so even if the style of communicating doesn't seem like it "should" matter, in practice it genuinely does if success is measured by whether the change happens or not.
Of course, if the goal is just to be right rather than to convince someone else about what's right, how you're saying something doesn't matter, but at that point you've already reached the goal before you started talking to them, so it's worth reexamining what you're actually looking to get out of a conversation at that point.
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#34Re: I found 39 Algolia admin keys exposed across open source documentation sites
#35I have been developing an OpenClaw-like agent that automates exactly this type of attack.
[flagged]
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#36Is this aloglia's (or any provider) responsability or each individual integration ?
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#37the wildest part is algolia just not responding. you email them saying "hey 39 of your customers have admin keys in their frontend" and they ghost you? thats way worse than the keys themselves imo. like the whole point of docsearch is they manage the crawling FOR you, but then the "run your own crawler" docs basically hand you a footgun with zero guardrails. they could just... not issue admin-scoped keys through that…
Why contact Algolia when it is the users' responsibility to handle their keys? Contact all the users.
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#38Twenty years ago every PHP website had search. We forgot how to do it.
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#39Twenty years ago every PHP website had search. We forgot how to do it.
To be fair, the search was thanks to databases and it was usually not very good (it takes work to set correctly).
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#40the wildest part is algolia just not responding. you email them saying "hey 39 of your customers have admin keys in their frontend" and they ghost you? thats way worse than the keys themselves imo. like the whole point of docsearch is they manage the crawling FOR you, but then the "run your own crawler" docs basically hand you a footgun with zero guardrails. they could just... not issue admin-scoped keys through that…
Why contact Algolia when it is the users' responsibility to handle their keys? Contact all the users.
If this happens so often, perhaps Algolia should improve their stuff to prevent this? For example, by implementing a dedicated search endpoint that doesn't accept normal API keys, but only dedicated read-only keys.