-werners-
Esteemed Contributor III

No I think you are correct. The key should not be exposed.

This is either a bug, or some missing config.

I should test it myself.