testing hidden API keys on github