Security Notice: Exposed HuggingFace API key detected

Hi there,

We found an exposed HuggingFace API key in this repository (ending in ...JmAV).

**What happened:** Your API key was committed to a public file and is visible to anyone. It has been viewed 4,853 times.

**Recommended steps:**
1. Revoke or rotate this key immediately
2. Check your billing dashboard for unexpected charges
3. Generate a new key and store it in environment variables or a secrets manager
4. Add your key patterns to a `.gitignore` or use tools like `git-secrets` to prevent future leaks

This was detected by [Unsecured API Keys](https://unsecuredapikeys.com), a security awareness tool that scans public repositories for accidentally exposed credentials.

Stay safe out there.

The issue names no repository file, only an exposed Hugging Face API key ending in ...JmAV. First locate the committed credential, then review the repository history and the recommended rotation steps. Done means the key is revoked or rotated, no longer exposed, and future leaks are addressed with environment variables, a secrets manager, .gitignore patterns, or git-secrets.

Written by the indexing model from the issue text.