`maps/smartphoneMap.jsp` ships a literal API key:
```jsp
var apiKey = "5ec0de94";
showRoute(agencyId, routeId, directionId, stopId, apiKey);
```
This bypasses the new config-based fail-loud path that PR #29 introduced (`template/includes.jsp` reads `transitclock.apikey` system property), makes rotation/environment overrides impossible, and bakes a stale key into client code. (`smartphoneMap.jsp` doesn't include `template/includes.jsp`, so it never picked up the new path.)
Fix: read the key from the config the way the rest of the app now does (e.g. injected via JSP scriptlet from `System.getProperty("transitclock.apikey")`), and fail loud if it's missing.
- File: `transitclockWebapp/src/main/webapp/maps/smartphoneMap.jsp` (lines 196–201)
- The literal key `5ec0de94` should also be rotated since it has been in the public repo.
Source
`maps/smartphoneMap.jsp` ships a literal API key:
```jsp
var apiKey = "5ec0de94";
showRoute(agencyId, routeId, directionId, stopId, apiKey);
```
This bypasses the new config-based fail-loud path that PR #29 introduced (`template/includes.jsp` reads `transitclock.apikey` system property), makes rotation/environment overrides impossible, and bakes a stale key into client code. (`smartphoneMap.jsp` doesn't include `template/includes.jsp`, so it never picked up the new path.)
Fix: read the key from the config the way the rest of the app now does (e.g. injected via JSP scriptlet from `System.getProperty("transitclock.apikey")`), and fail loud if it's missing.
Source