[bradleybuda]

They address this in the post: write keys are considered public (after all, they appear in JS code on customers’ sites).