Attrib control 'Improve this map' link exposes access token
Open
Nobody has claimed this yet.
needs investigation :mag:
- Dominant language
- TypeScript
- Stars
- 12.4k
- Forks
- 2.4k
- PR merge metrics
- No merged PRs in 30d
Description
**mapbox-gl-js version**: 3.10
**browser**: any
### Steps to Trigger Behavior
Standard map without any mods needed
### Expected Behavior
Access token should not be exposed on the map where it can easily be scraped and used elsewhere.
### Actual Behavior
The 'Improve this map' link includes the following:
```html
Improve this map
```
This is more of a security issue than bug report.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with a standard map and inspect where the attribution “Improve this map” link is generated. Confirm the access token is removed from the link while the link still provides the expected map feedback context.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100