Google Told the Researcher Nice Catch Then Refused to Pay and Never Fixed It

Tue, 23 Jun 2026 12:12:16 +0200

Google told a security researcher his bug was a nice catch, lined up his payout, then eleven days later called it harmless and refused to pay a cent. The flaw he reported lets anyone with basic Kubernetes access take over a complete Google Cloud organization in about five seconds, with three lines of text and no special permissions at all. Months on, it still is not fixed. He named it ConfigConfusion.

Google API Keys Keep Working for 23 Minutes After You Delete Them

Sat, 23 May 2026 15:04:37 +0200

Google tells you the key is gone. It keeps working for 23 more minutes. When you delete a Google API key, a dialog appears that says the following: “Once deleted, it can no longer be used to make API requests.” That is the message. It is printed there by Google, presented as fact at the exact moment you think the risk is gone. It is not true.

Security researcher Joe Leon at Aikido Security spent two days testing what actually happens after a key is deleted. He created keys, deleted them, and kept firing authenticated requests at Google’s servers at three to five per second until no valid response came back. He ran ten separate trials. The shortest window before a deleted key fully stopped working was nearly eight minutes. The median was sixteen minutes. The longest was just under twenty-three minutes. During all of that time, the key was authenticating successfully on Google’s infrastructure. A deleted key. Still working.

Google-Cloud on HackingPassion.com : root@HackingPassion.com-[~]

Google Told the Researcher Nice Catch Then Refused to Pay and Never Fixed It

Google API Keys Keep Working for 23 Minutes After You Delete Them