API key exposure