…you pasted the production API key into the prompt so the AI could "see the whole picture."

The gotchaAnything in a prompt may be logged, retained or echoed back into code. Use placeholders and keep secrets in your secret store.