Known Issue

Google Maps API Key Visible to all users

Precursive uses the Google Maps API to geocode Phase and Resource addresses to power the Proximity Search feature.

Google Maps API is a paid service which allows applications to embed and search from the Google Maps Database by means of an API key. Should the API be exposed, and its usage not restricted to the owner a malicious actor may be able to exploit this exposure resulting in substantial costs which may result in denial of service should the established bill quota be exceeded.

The Google Maps API Key is stored in a Public Custom Setting used fro general system settings which all Precursive users have access to. Although the users do not have a UI for viewing the settings with sufficient technical understanding they could construct a method to view the data by constructing a server request.

Do not use the Proximity Search feature if the risk of exposing the Google Maps API Key is identified as a high risk.