Security Notice: Exposed HuggingFace API key detected

Hi there,

We found an exposed HuggingFace API key in this repository (ending in ...JmAV).

**What happened:** Your API key was committed to a public file and is visible to anyone. It has been viewed 4,510 times.

**Recommended steps:**
1. Revoke or rotate this key immediately
2. Check your billing dashboard for unexpected charges
3. Generate a new key and store it in environment variables or a secrets manager
4. Add your key patterns to a `.gitignore` or use tools like `git-secrets` to prevent future leaks

This was detected by [Unsecured API Keys](https://unsecuredapikeys.com), a security awareness tool that scans public repositories for accidentally exposed credentials.

Stay safe out there.

Start by locating the public file and confirming the exposed HuggingFace key, then review the repository history to determine where it was committed. Revoke or rotate the credential, remove the exposed value from tracked content and history as appropriate, and verify that no credential remains accessible; the issue provides no filename or test to run.

Written by the indexing model from the issue text.