Put key in an environment variable so it doesn't expose secrets to repos.

It's a common practice to store keys in environment variables so that they don't get checked into code repositories. I believe that's a much better default than 'your key here'.