Security boffin claims airport group left API keys in client-side JavaScript for four years

Researcher believes overprivileged Iterable creds exposed 8.8M customer records - and could have enabled mass deletion