Privacy and exposed API keys

Nature of issue?

• New feature request

New feature details:

Currently, people who create sketches on the web editor using API keys are automatically exposing those keys to the world, and may not be aware they are doing so.

Right now searching the web editor for "apiKey" or similar strings
https://www.google.com/search?q="apiKey"+site%3Aeditor.p5js.org

...turns up a couple hundred examples from firebase, google maps, the new york times, giphy, mlab.com, pixabay, uifaces.co, wordnik, openweathermap.org, etc. Most of these are low security, but some are not.

Other than a robust private sketch feature, here are some ways of approaching this problem with features:

1. post a warning for the author if the editor recognizes an api string and api key. The author can ignore the warning or not.
2. advise the user to use save their sketch with the key variables empty / included.
3. advise the user to save their sketch with loading the key from localstorage. This is the workaround that codepen suggests: https://blog.codepen.io/2017/08/10/window-prompt-localstorage-api-keys/
4. offer an option for users to create private strings, AKA secrets. This is what glitch.com implements -- for example https://glitch.com/edit/#!/processing-js?path=.env:1:0

The issue names no files, tests, or entry points; start by locating how sketches are saved and how editor code is published. First agree on one privacy approach, then define its user-facing warning or secret-handling behavior and tests before implementation.