Does a Search-Only API key prevent enumeration of an entire Algolia index from the browser?

Preventing accidental public access to Algolia data requires choosing the correct API key type for client-side use. Algolia provides a tiered API key system with an Admin API Key for full read/write access, a Search-Only API Key for read-only queries, and Secured API Keys that can be signed with user-specific restrictions.

The design goal is to allow search from the browser without exposing write capabilities or data that should remain private to a tenant. The constraint is that a Search-Only key is still a read key for the entire index it is authorized against, and Secured API Keys are used to add filters and other restrictions per user.

There is uncertainty about the boundary between read-only safety and data visibility when only a Search-Only key is used.

Does a Search-Only API key allow a client to retrieve all records in an index by issuing broad queries with no filters? Which additional restrictions are required to prevent a user from accessing records outside their authorized scope when the index is shared? When is a Secured API Key with filters necessary instead of a plain Search-Only key?