Unauthenticated search key exposes all indexed records: Algolia default access control
When embedding Algolia search in a public frontend, the search-only API key is visible to every client, so its default access scope determines whether indexed data remains private. Algolia's documented security model indicates that unauthenticated search keys may have read-only access to all searchable attributes and records unless index-level restrictions a