Exposed key
In shortAn AI provider key left in a settings file on a device. EndLayer reports that it exists; the key itself is discarded.
Where it sits in EndLayer · step 2 of 7, signals
What it means
Keys often end up in plain settings files, for an MCP server or a coding agent. EndLayer records that a key is present and where, and throws the value away on the device before anything is sent.
The result is a finding with an owner, not a copy of the secret.
Why it matters
A key in a file is a key anyone with the laptop can use. Knowing where they are is how you rotate them.