Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 39 Algolia admin keys exposed across open source documentation sites

benzimmermann.dev

Post reply on HN
Print view View original

61–62 of 62 posts

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#61

Post by pwdisswordfishy »

richbell wrote: post #14
pwdisswordfishy wrote: post #12

Earlier quoted context omitted.

Yes, and in the real world where Grice's Maxim of Relevance is in force, then when the secrets issuer that is the subject of the discussion isn't one of those partners, then an informative "reminder" that GitHub "has a secret scanning program" with a bunch of other partners is not actually informative. It's as superfluous and unhelpful as calling to let someone know you're not interested in the item they've posted fo…

How is reminding people that they can safely revoke exposed API keys not informative? Why are you being so combative?

Because "This has to be one of the dumbest, most reckless threads to have been posted (and so vociferously defended) on HN."

https://news.ycombinator.com/item?id=47419913

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#62

Post by nyagudayev1 »

Hey, I'm Natan, Engineering Manager at Algolia. I wanted to acknowledge the issue raised in this thread and for posterity, show how we’re responding.

Some DocSearch implementations exposed write/admin API keys in public frontend config. That should not happen, but sometimes it does, and it underscores the importance of making API key roles and safe usage clearer. Only search-only keys belong client-side. Exposed privileged keys can allow unauthorized index changes or deletion.

We've contacted affected users directly to rotate exposed keys, move privileged keys to backend-only environments, and verify that public configs use search-only keys only.

More broadly, this is a reminder that education and guardrails around API key usage matter, and we're taking that seriously. We’ll continue to ensure this advice is surfaced more prominently throughout our product, and also look to enforce better guardrails to hopefully mitigate it before it happens.

Cheers, Natan

Post reply on HN