it's easy to scan for publicly known services, really difficult to understand if a random string that says key somewhere is actually a random internal api key