Yeah we knew that it was gonna sound iffy. I can only say that the API key isn't collected by us when you enter it but I understand you can't just trust us on that. It's a 48h game jam game, it wasn't possible to do a truly secure game so it is what it is.