The Insecure Default Was the Configuration

I found an API key hardcoded as a fallback in three scripts and did the obvious thing: deleted it, moved the value to an env file, felt responsible. Then I checked whether anything actually set that variable. Nothing did. The literal I had just remov