Security Notice: Exposed HuggingFace API key detected

Hi there,

We found an exposed HuggingFace API key in this repository (ending in ...JmAV).

**What happened:** Your API key was committed to a public file and is visible to anyone. It has been viewed 6,371 times.

**Recommended steps:**
1. Revoke or rotate this key immediately
2. Check your billing dashboard for unexpected charges
3. Generate a new key and store it in environment variables or a secrets manager
4. Add your key patterns to a `.gitignore` or use tools like `git-secrets` to prevent future leaks

This was detected by [Unsecured API Keys](https://unsecuredapikeys.com), a security awareness tool that scans public repositories for accidentally exposed credentials.

Stay safe out there.

No repository file, test, or entry point is identified. A maintainer should first verify and revoke the exposed HuggingFace key, inspect repository history for the secret, and determine whether history cleanup and preventive secret scanning are required; done means the credential is invalid and no exposed copy remains.

Written by the indexing model from the issue text.