i have seen this the partner company sent us an implementation doc that was full of red flags, "just send your private API key to the client packed deep in a n

i have seen this the partner company sent us an implementation doc that was full of red flags, "just send your private API key to the client packed deep in a nested JSON and ROT13 it to authenticate requests, users aren't technical enough to unpack it" sort of place after I kicked it back to the director saying there was no way I was going to sign my name to that jank code, they tried implementing it themselves anyway, and were found out during a routine "check if API keys are leaking" job