Maps keys are always public in js on the website (but locked to use on certain domains). That’s how they work.
It is not actually locked to a site is just based off the host header. Which is public information an attacker can use to make the requests.
alt Hacker News
It is not actually locked to a site is just based off the host header. Which is public information an attacker can use to make the requests.