It only gets worse when the company that published their environment variables sues the security researchers for finding it. It happens.