Gemini

1. 011 key for Gemini is in source control, including a public repository. Rotate them now, move to a secret manager, and turn on push protection so it cannot happen again.
2. 02Gemini trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
3. 03Gemini SDKs appear in 1 repository. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally.
4. 04Direct HTTP calls to generativelanguage.googleapis.com bypass any SDK-level controls. Add the hosts to egress policy and prefer the sanctioned client library.

• ●Medium45GeminiSIEM · Splunk (demo)2 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

No people are linked to this app.

1. source_code · Sep 2, 2026
   Gemini in 1 repository via GitHub (demo): packages google-generativeai; direct calls to generativelanguage.googleapis.com; 1 hardcoded or alerted keys
   Detail

   {
     "repos": [
       "contoso/research-notebooks"
     ],
     "configs": [],
     "packages": [
       {
         "name": "google-generativeai",
         "repos": 1,
         "ecosystem": "pypi"
       }
     ],
     "endpoints": [
       {
         "host": "generativelanguage.googleapis.com",
         "repos": 1
       }
     ]
   }

2. code_secret
   Google API key in contoso/research-notebooks at config.py
   Detail

   {
     "path": "config.py",
     "repo": "contoso/research-notebooks"
   }

3. corroboration
   Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:google-gemini)
   Detail

   {
     "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:google-gemini"
   }