A lot of search engines (Google, Bing, etc.) allow you to add your domain to their monitoring panel. You can associate your domain to your account as long as you can prove that you manage that domain or the underlying website.
The verification process changes from service to service, but the most basic and widely-adopted automated strategy is the generation of a "site verification token" that must match the one you need to expose in a DNS TXT record (where the exact record name usually contains the token or part of it); or, the creation of a file containing a token that must be served by your web server (where the exact filename contains the token or part of it).
Often, this token can be seen published. Usually, by mistake. You may be able to find thousands of them on public repositories like GitHub etc.
Example of a Google site verification token, in a DNS zone:
300 IN TXT "google-site-verification=JZcDdsNvovvz6R65KGfHgEAN4M3qaurfd-Hxudthoui"
The question is:
Are there risks about the disclosure of a site verification token?
As far as I can imagine, no. Anyway maybe I'm ignoring some factors. Thank you for thoughts.