Security boffins scoured the web and found hundreds of valid API keys

A research study scanning ~10 million websites found nearly 2,000 exposed API credentials across thousands of pages, including AWS, GitHub, Stripe, and other sensitive service tokens. Most exposures were in JavaScript bundles and persisted for an average of 12 months; researchers reported findings to affected parties and observed a substantial reduction after disclosure.