Checklists are cool and all. But, you shouldn't need a checklist to know that you shouldn't ship API keys.