A security researcher found that deleted GCP API keys remain active for up to 23 minutes. Here's what that means for you, your frontend app, and incident response.