EngineeringScoreExposure Medium
Rotate the exposed SendGrid API key
A SendGrid API key can send email as the account's verified sender and read delivery and activity data. In the wrong hands that is enough to run a phishing campaign that appears to come from a trusted domain, or to quietly read who the business communicates with.
Why it matters
A SendGrid API key can send email as the domain's verified sender, which is enough to run a convincing phishing campaign that looks like it came from a trusted source.
How to fix
- 1 Revoke the key in the SendGrid dashboard (Settings > API Keys) and generate a new one. Revoking is what stops it from working.
- 2 Move any use of the key to a server-side environment; never ship a SendGrid API key to the browser.
- 3 Purge it from git history so it is not recoverable from a prior commit.
- 4 Redeploy, confirm the new build no longer ships the key, and review recent send activity for anything unexpected.
Common mistakes
- Revoking the key in SendGrid but not checking whether the same value was reused in another service or environment that also needs updating.
- Scoping the key with full account access when the feature that uses it only ever needs to send mail, which increases the damage if it leaks.
- Removing the key from the current build without purging it from git history, leaving it retrievable from any prior commit.
How to verify
- 1 Re-run the scan and confirm the SendGrid key finding is gone.
- 2 Grep the built/deployed JavaScript bundle for the SG. prefix to confirm no key remains.
- 3 Confirm the revoked key now fails SendGrid API calls rather than assuming revocation took effect.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.