# From an Innocent api-key to PII data

Yotpo loyalty API keys hardcoded in a customer site's JS authenticated to loyalty.yotpo.com, exposing customer PII via the recent-customers endpoint.

- Payout: unconfirmed
- Severity: critical
- Program: -
- Credited: g30rgy th3 d4rk
- Disclosed: 2023-03-30
- Write-up quality: 6/10
- Original: https://crypt0g30rgy.github.io/post/Journey2pII
- Library page: https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-journey2pii
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:critical technique:js-analysis technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** Yotpo Loyalty API (loyalty.yotpo.com) and customer storefront JS
**Root cause:** Storefront page embedded Yotpo loyalty API key and GUID in a script tag; those same keys served as authentication for the loyalty API, which returned customer records.
**Steps:**
1. Visit https://customers.jij0.me/ and view-source
2. Find script tag with YOTPO-API-KEY and YOTPO-GUID
3. Request `GET /api/v2/customers/recent?per_page=100` to loyalty.yotpo.com without headers to observe 401
4. Resend with `X-Guid: GUID_HERE` and `X-Api-Key: API_KEY_HERE` headers
5. Observe PII returned in JSON response
**How found:** Routine view-source of subdomains to hunt hardcoded creds/tokens; found Yotpo keys in a script tag, then read Yotpo developer docs to learn the keys doubled as loyalty API auth keys.
**Exploitation:** Using the leaked API key and GUID as auth headers, a single GET to /api/v2/customers/recent?per_page=100 returned customer PII; no further escalation attempted.
**Insight:** Third-party loyalty/marketing widgets often embed merchant API keys in storefront JS, and those keys may be the same credentials used for the vendor's server-side API — check vendor docs to see if the public key authenticates privileged endpoints.