I’ve seen too many repos with API keys hardcoded.
For MVPs, use environment variables + a secrets manager (Vercel, Netlify, GitHub Actions).
Takes minutes to set up, prevents hours of headaches.
Security doesn’t have to be complicated, just not careless.