Unauthenticated search key exposes all indexed records: Algolia default access control

When embedding Algolia search in a public frontend, the search-only API key is visible to every client, so its default access scope determines whether indexed data remains private. Algolia's documented security model indicates that unauthenticated search keys may have read-only access to all searchable attributes and records unless index-level restrictions are explicitly configured. The uncertainty is whether current defaults automatically limit exposure or whether every index requires manual restriction through settings such as restrictToPattern and attributesToRetrieve.

Differences across Algolia dashboard versions may affect how these restrictions are applied, making it unclear whether a key configured in one release behaves identically in another. Without a dependable verification method, teams cannot easily confirm that a frontend search key is not exposing unintended attributes to unauthenticated users.

Does the default Algolia search-only API key restrict access to specific indices and attributes, or does it expose all searchable records unless manually constrained? How do dashboard version differences affect the enforcement of index-level restrictions on search keys? What verification approach reliably confirms that an unauthenticated search key is not exposing unintended attributes?