-1

I just happened upon the FireAlarm chat room and noticed this message

Just tried the [URL][2] that was in the exception message, and it seems as though I can crawl questions with that API key...

How bad is this? I don't know the standard procedure for reporting these incidents

[2]: https://api.stackexchange.com/2.2/questions/2414660?key=HNA2dbrFtyTZxeHN6rThNg((&filter=!-*f(6rOFHc24&site=stackoverflow

3
  • 6
    FireAlarm is a third-party app which runs off of the Stack Overflow API, so informing the maintainers would be the right approach. It isn't a bug per se on Stack Overflow.
    – Makoto
    Apr 4, 2017 at 3:42
  • 3
    (bot's maintainer here) The API key isn't "private". It is completely safe exposing the API key in error messages. Nothing to worry about. Apr 4, 2017 at 9:15
  • @AshishAhuja ok cool. Closing
    – Isaac
    Apr 5, 2017 at 0:27

1 Answer 1

4

How bad is this?

I don't think it's devastating that an API key gets leaked, as API keys alone provide read-only access with per-IP quotas - to impersonate users with write access you would need an access token as well.

As for who to contact, the owner(s) of the key would be the best person/people to notify. In this case, you should contact NobodyNada and Ashish Ahuja, the current maintainers of FireAlarm, who would then decide if a new API key should be created.

5
  • 10
    The source for FireAlarm is on GitHub, including the API key... So this cannot be a big concern.
    – Shog9
    Apr 4, 2017 at 4:09
  • 5
    In the registration page for an app on StackApps this is the comment for the Key field: This is not considered a secret, and may be safely embed in client side code or distributed binaries.. Compare that with the Client Secret field that is also found on the registered app page: This must be kept secret. Do not embed it in client side code or binaries you intend to distribute. If you need client side authentication, use the implicit OAuth 2.0 flow. That field also offers an reset link so you can generate a new client secret.
    – rene
    Apr 4, 2017 at 7:40
  • (bot's maintainer here) You don't need to create a new API key. The API key is not something secret like rene said. Most bots have the API key on the web, and even the registration page on SA says that it is not a secret. It would be a problem if someone used our API key because that would deplete the bot's quota, but till now nothing has happened and I don't think we need to worry. Apr 4, 2017 at 9:13
  • @Ashish The quota's per-IP, so it wouldn't do anything to our quota.
    – NobodyNada
    Apr 4, 2017 at 14:15
  • @NobodyNada ah, right. Forgot about that >_< Apr 4, 2017 at 15:29

Not the answer you're looking for? Browse other questions tagged .