Security Risk - Public access to your API Keys

[EpicnessTwo]

This is a nice system but storing the API keys in a public place isn't such a good idea. It doesn't take long for someone to find the config.js file and then they have a copy of your API key which can be used to change most things to do with Monitors on your account, add contacts or even remove everything.

I think it would be wise to either change this or let people know that this is not secure in a public setup.

[MACscr]

Obviously a person should only be using read only api keys. So not a security risk. For a javascript only project, there really isnt any other option.

[EpicnessTwo]

This issue is over 4 years old. I don't recall there being seperate read-only api keys back then either.