fix: google maps api key is embedded directly in cli... in...

[anupamme]

Summary

Fix critical severity security issue in lib/client-assets.php.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	lib/client-assets.php:61
Assessment	Likely exploitable
Chain Complexity	2-step

Description: Google Maps API key is embedded directly in client-side JavaScript registration, exposing it to end-users who can extract it via browser developer tools or network interception.

Evidence

Exploitation scenario: An attacker who can access the web application can open browser developer tools, inspect network requests, and extract the Google Maps API key from the script source URL.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• lib/client-assets.php

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security