We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your
index.html. A few examples of such tools are:
- Google Analytics
- Google Maps
- Zendesk Web Widget
Usually, such tools give you some sort of key that identifies with your account. But that key is publicly visible to every visitor of the website as it is hardcoded into the
Therefore I was wondering, whether there are any protections against malicious users getting my key and using it for bad purposes, e.g.
- spamming my Zendesk inbox.
- spamming my Google Analytics with fake data, that is indistinguishable from real user data.
- using up the whole of my Google Maps query quota by reusing the same key in their website.
I haven't tested all of the scenarios, but e.g. Zendesk works on our dev/test environments out of the box, suggesting that this could be an issue.