A broken map thread that ends with someone pasting a live API key in plain text
"Map not working, need an API key?" → *pastes the actual key into the thread*
What Superflow captured automatically
- Issue type
- Security
- Site
- Client marketing site
- Platform
- Webflow
- Browser
- Chrome 130
- OS
- macOS
- Device
- Desktop
- Date
- Nov 2024
- Status
- Resolved
Every Superflow comment ships with this context - no "what browser were you on?" follow-ups.
Why it matters
The bug was a broken map. The real find was a live credential pasted into a comment thread - the kind of thing that ends up scraped, quota-drained, and billed to your card. Rotate keys, friends.
Map not working, assume you need an API key again?
Might need to style a snazzy map. I'd like to get this working before sending as it's been too long to say we're still working on something
<iframe src="[maps embed URL]" width="100%" height="600px" style="border:none;">
API KEY: AIzaSy••••••••••••••••••••••••• [redacted — yes, it was the real key]