# A broken map thread that ends with someone pasting a live API key in plain text

> "Map not working, need an API key?" → *pastes the actual key into the thread*

This is the Markdown copy of https://usesuperflow.ai/bug-book/api-key-in-the-thread, published for AI agents and scripts. The HTML page is canonical.

## Key facts

| Field | Value |
| --- | --- |
| Page type | Bug Book entry |
| URL | https://usesuperflow.ai/bug-book/api-key-in-the-thread |
| Issue type | Security |
| Severity | Critical |
| Status | Resolved |
| Site | Client marketing site |
| Platform | Webflow |
| Captured on | Chrome 130, macOS, Desktop |
| Date | 2024-11-01 |

## Why it matters

The bug was a broken map. The real find was a live credential pasted into a comment thread - the kind of thing that ends up scraped, quota-drained, and billed to your card. Rotate keys, friends.

## Outcome

Resolved. The key has been redacted here so it stays that way.

## The thread

- **Designer:** Map not working, assume you need an API key again?
- **Designer:** Might need to style a snazzy map. I'd like to get this working before sending as it's been too long to say we're still working on something
- **Developer:** <iframe src="[maps embed URL]" width="100%" height="600px" style="border:none;">
- **Developer:** API KEY: AIzaSy••••••••••••••••••••••••• [redacted - yes, it was the real key]

## About Superflow

Superflow is a website and creative-asset review tool. Its agents watch every page of a site, report what changed, and route findings to the people who approve them. Teams leave contextual feedback on live sites, staging environments, PDFs, images, videos, and Lottie animations, and comments sync two-way with Asana, ClickUp, Monday, Slack, Webflow, and Google Tag Manager.

Machine-readable entry points:

- Site index: https://usesuperflow.ai/llms.txt
- Full site content in one fetch: https://usesuperflow.ai/llms-full.txt
- Free tools, with a Markdown copy of each: https://usesuperflow.ai/tools.md
- MCP server (Streamable HTTP, no account and no API key): https://usesuperflow.ai/api/mcp
- Agent card: https://usesuperflow.ai/.well-known/agent-card.json