Open Record Step 4: Credentials, Handled

If either of your sources needs a key, get one and wire it up properly: in an environment file, that file in .gitignore, read from the environment in code, never printed. Add a User-Agent identifying your project with a way to reach you. Then check your repository honestly: run git log -p and search it for anything that looks like a credential. If you find one, rotate it now. If neither source needs a key, do this anyway with a placeholder, because the habit is what you are building.