Google API Keys Remain Active After Deletion

This article details a significant vulnerability in Google Cloud Platform (GCP) API key deletion processes. Researcher Joe Leon of Aikido Security discovered that API keys can remain active for up to 23 minutes after deletion, creating a window of opportunity for attackers to continue abusing them. This discrepancy bet…