How Bad Would It Really Be If Your API Key Leaked?
The severity of an API key leak isn't just about whether a key got out — it's about what that key can do, how many services it's wired into, and how long it sat unrotated. A read-only key exposed for a day and an admin key connected to a dozen services left untouched for months can differ in actual damage by an order of magnitude or more.
This calculator takes permission scope (read-only/read-write/admin), the number of connected services, and how long the key has been exposed or unrotated, then produces an overall risk score. If the score comes out high, revoke and reissue the key immediately, and going forward apply the principle of least privilege along with a regular rotation policy. If the key was ever committed to a repository, make sure to purge it from the history too, not just the latest commit.
Frequently Asked Questions
A read-only leak only exposes data for viewing, while write/delete or admin keys can lead to data tampering, deletion, or billing access — much broader damage.
Grant only the minimum permissions needed, rotate keys regularly, and manage them with environment variables or a secrets manager instead of hardcoding.