Pushed an API key to GitHub? The checklist