> Turns out, most of it is useless: For using most data, you need more information than just the api key. I think you mean low effort attacks. A determined at

> Turns out, most of it is useless: For using most data, you need more information than just the api key. I think you mean low effort attacks. A determined attacker would attempt to gather more information, for example research the author of the post. Many of the authors give enough clues so that you can identify a person, even if comments are written using different handles. Also some of these secrets go in pairs with something else that is enough to get a successful auth. For example, AWS secret usually goes in pair with everything you need to connect.