Keys on Doormats: Exposed API Credentials on the Web

• URL: http://arxiv.org/abs/2603.12498v2
• Date: Mon, 16 Mar 2026 02:10:30 GMT
• Title: Keys on Doormats: Exposed API Credentials on the Web
• Abstract summary: We study exposure of credentials on the web by analyzing 10M webpages.<n>Our findings reveal that API credentials are widely and publicly exposed on the web, including highly popular and critical webpages.<n>We characterize web-specific exposure vectors and root causes, finding that most originate from JavaScript environments.
• Score: 6.429650787243443
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Application programming interfaces (APIs) have become a central part of the modern IT environment, allowing developers to enrich the functionality of applications and interact with third parties such as cloud and payment providers. This interaction often occurs through authentication mechanisms that rely on sensitive credentials such as API keys and tokens that require secure handling. Exposure of these credentials can pose significant consequences to organizations, as malicious attackers can gain access to related services. Previous studies have shown exposure of these sensitive credentials in different environments such as cloud platforms and GitHub. However, the web remains unexplored. In this paper, we study exposure of credentials on the web by analyzing 10M webpages. Our findings reveal that API credentials are widely and publicly exposed on the web, including highly popular and critical webpages such as those of global banks and firmware developers. We identify 1,748 distinct credentials from 14 service providers (e.g., cloud and payment providers) across nearly 10,000 webpages. Moreover, our analysis of archived data suggest credentials to remain exposed for periods ranging from a month to several years. We characterize web-specific exposure vectors and root causes, finding that most originate from JavaScript environments. We also discuss the outcomes of our responsible disclosure efforts that demonstrated a substantial reduction in credential exposure on the web.

Related papers

• State of Passkey Authentication in the Wild: A Census of the Top 100K sites [1.5822425915135876]
  Passkeys are discoverable WebAuthn credentials synchronised across devices.<n>Major vendors have integrated passkeys into operating systems and browsers.<n>Yet the true extent of adoption across the broader web remains unknown.
  arXiv  Detail & Related papers  (2026-02-16T19:28:55Z)
• Nested Browser-Use Learning for Agentic Information Seeking [60.775556172513014]
  Information-seeking (IS) agents have achieved strong performance across a range of wide and deep search tasks, yet their tool use remains largely restricted to API-level snippet retrieval and URL-based page fetching.<n>We propose Nested Browser-Use Learning (NestBrowse), which introduces a minimal and complete browser-action framework that decouples interaction control from page exploration through a nested structure.
  arXiv  Detail & Related papers  (2025-12-29T17:59:14Z)
• HackWorld: Evaluating Computer-Use Agents on Exploiting Web Application Vulnerabilities [20.201614123811872]
  HackWorld is the first framework for evaluating computer-use agents' capabilities to exploit web application vulnerabilities via visual interaction.<n>It includes 36 real-world applications across 11 frameworks and 7 languages, featuring realistic flaws such as injection vulnerabilities, authentication bypasses, and unsafe input handling.<n>It tests CUAs' capacity to identify and exploit these weaknesses while navigating complex web interfaces.
  arXiv  Detail & Related papers  (2025-10-14T06:52:15Z)
• DRBench: A Realistic Benchmark for Enterprise Deep Research [81.49694432639406]
  DRBench is a benchmark for evaluating AI agents on complex, open-ended deep research tasks in enterprise settings.<n>We release 15 deep research tasks across 10 domains, such as Sales, Cybersecurity, and Compliance.
  arXiv  Detail & Related papers  (2025-09-30T18:47:20Z)
• VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents [74.6761188527948]
  Computer-Use Agents (CUAs) with full system access pose significant security and privacy risks.<n>We investigate Visual Prompt Injection (VPI) attacks, where malicious instructions are visually embedded within rendered user interfaces.<n>Our empirical study shows that current CUAs and BUAs can be deceived at rates of up to 51% and 100%, respectively, on certain platforms.
  arXiv  Detail & Related papers  (2025-06-03T05:21:50Z)
• Beyond Browsing: API-Based Web Agents [58.39129004543844]
  API-Based Agents outperform web Browsing Agents in experiments on WebArena.<n>Hybrid Agents out-perform both others nearly uniformly across tasks.<n>Results strongly suggest that when APIs are available, they present an attractive alternative to relying on web browsing alone.
  arXiv  Detail & Related papers  (2024-10-21T19:46:06Z)
• Non-Fungible Programs: Private Full-Stack Applications for Web3 [0.3683202928838613]
  This paper introduces the Non-Fungible Program (NFP) model for developing self-contained applications. NFP applications are distributed blockchain, powered by Web technology, and backed by private databases in smart contracts. Access to code, as well as backend services, is controlled and guaranteed by smart contracts according to the NFT ownership model.
  arXiv  Detail & Related papers  (2024-04-24T03:46:18Z)
• Assessing Web Fingerprinting Risk [2.144574168644798]
  Browser fingerprints are device-specific identifiers that enable covert tracking of users even when cookies are disabled. Previous research has established entropy, a measure of information, as the key metric for quantifying fingerprinting risk. We provide the first study of browser fingerprinting which addresses the limitations of prior work.
  arXiv  Detail & Related papers  (2024-03-22T20:34:41Z)
• Finding Vulnerabilities in Mobile Application APIs: A Modular Programmatic Approach [0.0]
  Application Programming Interfaces (APIs) are becoming increasingly popular to transfer data in a variety of mobile applications. These APIs often process sensitive user information through their endpoints, which are potentially exploitable due to developer mis implementation. This paper created a custom, modular endpoint vulnerability detection tool to analyze information leakage in various mobile Android applications.
  arXiv  Detail & Related papers  (2023-10-22T00:08:51Z)
• Reinforcement Learning on Encrypted Data [58.39270571778521]
  We present a preliminary, experimental study of how a DQN agent trained on encrypted states performs in environments with discrete and continuous state spaces. Our results highlight that the agent is still capable of learning in small state spaces even in presence of non-deterministic encryption, but performance collapses in more complex environments.
  arXiv  Detail & Related papers  (2021-09-16T21:59:37Z)
• Simple Transparent Adversarial Examples [65.65977217108659]
  We introduce secret embedding and transparent adversarial examples as a simpler way to evaluate robustness. As a result, they pose a serious threat where APIs are used for high-stakes applications.
  arXiv  Detail & Related papers  (2021-05-20T11:54:26Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.