Exposed Unrestricted Google API Key in Client-Side: JavaScript Allows Unauthorized API AbuseClick to read the full walkthrough.