The iotplotter feed api-key is now loaded from the environment (process.env.IOTPLOTTER_KEY, via a gitignored .env — see .env.example). It is no longer hardcoded in source.

An earlier version (redux-build.js, now removed) hardcoded a live api-key that was committed to this repository's public git history. Removing the file from the working tree does not remove it from history — the old key remains retrievable from past commits on the public remote.

• Treat the old key as compromised. Rotate it at iotplotter.com and put the new value in .env.
• History was intentionally not scrubbed (low-sensitivity feed, decision deferred). If you later want it gone from history, use git filter-repo (or BFG) with a replace-text rule and force-push — note this rewrites all commit SHAs on the public remote.

.env is gitignored; never commit real keys.