8 ms·
The entire thing is frontend only (except for the share feature) so the server never sees your key. You can validate that by watching the network tab in develop
by z991 3y ago
The entire thing is frontend only (except for the share feature) so the server never sees your key. You can validate that by watching the network tab in developer console. You can also make a new / revoke an API key to be extra sure.
- jquery 3y agoPlease make a new API key folks. There's a lot of tricks to scrape a text box and watching the network tab isn't enough for safety.
- gardenhedge 3y agoWho could scrape the text box in this scenario?
- wise_young_man 3y agoChrome extension malware.
- jquery 3y agoGood luck spotting it if it's attached to the window.onclose event. Chrome extensions could save it to storage. Probably even some chrome vulnerabilities (it would just be a devtools network tab bypass so not technically a 0-day). And that's just top of mind, I'm sure there's other methods.