I would recommend not “hacking” something like this and publically admitting it on HN. Pretty much made me distrust all of your work if you are going to take shortcuts like this that expose your API key. Adding a “taking the time to fix this now” probably would have been sufficient for me to think differently.