My First Accepted HackerOne Report: Finding Exposed Weglot API Keys Across 5 Targets

Title: My First Accepted HackerOne Report: Finding Exposed Weglot API Keys Across 5 Targets

URL Source: https://medium.com/@ziadali200244/my-first-accepted-hackerone-report-finding-exposed-weglot-api-keys-across-5-targets-fb14ecda869b?source=rss------cybersecurity-5

Published Time: 2026-04-15T12:44:48Z

Markdown Content:
# My First Accepted HackerOne Report: Finding Exposed Weglot API Keys Across 5 Targets | by Ziadali | Apr, 2026 | Medium

[Sitemap](https://medium.com/sitemap/sitemap.xml)

[Open in app](https://play.google.com/store/apps/details?id=com.medium.reader&referrer=utm_source%3DmobileNavBar&source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2F%40ziadali200244%2Fmy-first-accepted-hackerone-report-finding-exposed-weglot-api-keys-across-5-targets-fb14ecda869b&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

[](https://medium.com/?source=post_page---top_nav_layout_nav-----------------------------------------)

Get app

[Write](https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav------------------)

[Search](https://medium.com/search?source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2F%40ziadali200244%2Fmy-first-accepted-hackerone-report-finding-exposed-weglot-api-keys-across-5-targets-fb14ecda869b&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)


# My First Accepted HackerOne Report: Finding Exposed Weglot API Keys Across 5 Targets

[](https://medium.com/@zx10a?source=post_page---byline--fb14ecda869b---------------------------------------)

[Ziadali](https://medium.com/@zx10a?source=post_page---byline--fb14ecda869b---------------------------------------)

Follow

2 min read

·

Just now

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2Ffb14ecda869b&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40zx10a%2Fmy-first-accepted-hackerone-report-finding-exposed-weglot-api-keys-across-5-targets-fb14ecda869b&user=Ziadali&userId=310c13319f44&source=---header_actions--fb14ecda869b---------------------clap_footer------------------)

47

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Ffb14ecda869b&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40zx10a%2Fmy-first-accepted-hackerone-report-finding-exposed-weglot-api-keys-across-5-targets-fb14ecda869b&source=---header_actions--fb14ecda869b---------------------bookmark_footer------------------)

[Listen](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2Fplans%3Fdimension%3Dpost_audio_button%26postId%3Dfb14ecda869b&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40ziadali200244%2Fmy-first-accepted-hackerone-report-finding-exposed-weglot-api-keys-across-5-targets-fb14ecda869b&source=---header_actions--fb14ecda869b---------------------post_audio_button------------------)

Share


Good evening everyone. This writeup is about my **first report accepted on HackerOne** and how I found the same issue on **5 different targets**.

Today we’ll talk about **Weglot API keys**.

## What is Weglot?

Weglot is a paid translation service used by many websites to provide multilingual content. It works through an API that handles translation requests.

## How I Found It

While testing websites, I checked the **page source** and JavaScript files.

A common indicator was keys or variables s