Your coding agent just read your API keys. I built a local check so they don't reach the model.