{"id":50959307,"url":"https://github.com/moorada/gcpapikeyauditor","last_synced_at":"2026-06-18T11:33:00.172Z","repository":{"id":364991173,"uuid":"1269952505","full_name":"moorada/gcpapikeyauditor","owner":"moorada","description":"Static HTML/CSS/JS app to audit a Google Cloud API key","archived":false,"fork":false,"pushed_at":"2026-06-15T11:48:08.000Z","size":53,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-15T12:25:40.902Z","etag":null,"topics":["apikey","audit","cloud","gcp","penetration-testing","redteam","security"],"latest_commit_sha":null,"homepage":"https://gcpapikeyauditor.alongale.com/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/moorada.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-15T08:49:50.000Z","updated_at":"2026-06-15T11:48:11.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/moorada/gcpapikeyauditor","commit_stats":null,"previous_names":["moorada/gcpapikeyauditor"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/moorada/gcpapikeyauditor","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moorada%2Fgcpapikeyauditor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moorada%2Fgcpapikeyauditor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moorada%2Fgcpapikeyauditor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moorada%2Fgcpapikeyauditor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/moorada","download_url":"https://codeload.github.com/moorada/gcpapikeyauditor/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moorada%2Fgcpapikeyauditor/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34489153,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-18T02:00:06.871Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apikey","audit","cloud","gcp","penetration-testing","redteam","security"],"created_at":"2026-06-18T11:32:59.211Z","updated_at":"2026-06-18T11:33:00.149Z","avatar_url":"https://github.com/moorada.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# GCP API Key Auditor\n\n**[→ Try it live at gcpapikeyauditor.alongale.com](https://gcpapikeyauditor.alongale.com/)**\n\n---\n\nBrowser-based tool to audit a Google Cloud API key and estimate its exposure surface:\n\n- Which APIs are reachable from a browser context\n- Whether key restrictions (referrer / IP / app) are enforced\n- Abuse impact per endpoint (cost, data access, auth risk)\n- Automatic project-ID disclosure detection and project-scoped probes\n\nNo data leaves your environment — the key is only sent directly to Google APIs (or through your own proxy).\n\n---\n\n## Architecture\n\n| Layer | Technology |\n|-------|-----------|\n| Frontend | Static HTML / CSS / JS — no build step |\n| Backend proxy | Cloudflare Pages Functions (`/functions/api/`) |\n| Hosting | Cloudflare Pages |\n\nThe proxy is required only for endpoints that block browser CORS (Maps REST, some AI APIs). Without it the tool runs in **client-only mode** using JSONP for Maps endpoints.\n\n---\n\n## Local development\n\n### Option A — Wrangler (recommended, mirrors production)\n\nRuns both the static frontend and the Pages Functions locally.\n\n```sh\nnpm install\nnpm run dev\n```\n\nOpen `http://localhost:8787`. The backend activates automatically.\n\n### Option B — Node.js proxy\n\n```sh\nnpm install\nnpm start\n```\n\nOpen `index.html` directly in the browser. The backend on `localhost:3001` is detected automatically.\n\n### Option C — Client-only (no install)\n\nJust open `index.html` in any browser. Maps REST endpoints fall back to JSONP; other CORS-blocked probes will show as `unknown`.\n\n---\n\n## Deploy to Cloudflare Pages\n\n### First deploy (via CLI)\n\n```sh\nnpm install\nnpx wrangler login\nnpm run deploy:cli\n```\n\nWrangler will create the Pages project and print the deployment URL.\n\n### Configure a custom domain\n\n1. In the [Cloudflare dashboard](https://dash.cloudflare.com), go to **Pages → your project → Custom domains**.\n2. Add your domain (e.g. `gcpapikeyauditor.alongale.com`).\n3. Cloudflare will add the DNS record automatically if your domain is on the same account.\n\n### Subsequent deploys\n\nPush to `main` — Cloudflare Pages auto-deploys on every push. No build command needed; leave both **Build command** and **Deploy command** empty in the dashboard.\n\nTo deploy manually from the CLI instead:\n```sh\nnpm run deploy:cli\n```\n\n---\n\n## Security notes\n\n- The proxy (`/functions/api/probe.js`) only forwards requests to `*.googleapis.com` over HTTPS. All other targets are rejected with HTTP 403.\n- The API key travels in the POST body, never in URLs or query parameters, so it does not appear in Cloudflare access logs.\n- The tool is a **client-side exposure estimate**. It cannot read internal GCP key policy or IAM configuration without OAuth credentials.\n\n---\n\n## Probe coverage\n\n| Category | APIs tested |\n|----------|-------------|\n| Maps | Geocoding, Places, Directions, Distance Matrix |\n| AI | Gemini, Vision, Translation, Natural Language, Text-to-Speech, Speech-to-Text |\n| Location | Geolocation |\n| Auth | Firebase Identity Toolkit |\n| Media | YouTube Data v3, Google Books |\n| Search | Custom Search, Knowledge Graph |\n| Firebase | Dynamic Links |\n| Storage* | Cloud Storage bucket list |\n| Infrastructure* | Pub/Sub topic list |\n\n\\* Added automatically when a project ID is discovered via error response leakage.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoorada%2Fgcpapikeyauditor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmoorada%2Fgcpapikeyauditor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoorada%2Fgcpapikeyauditor/lists"}