This article [0] says they should have used secrets management, since they are using Kubernetes anyway, so this seems to be about their server, not the embedded

This article [0] says they should have used secrets management, since they are using Kubernetes anyway, so this seems to be about their server, not the embedded or Android code. Doesn't accessing the hard coded api keys imply to intrude the server in the first place? [0] https://www.404media.co/researchers-prove-rabbit-ai-breach-by-sending-email-to-us-as-admin/ https://www.404media.co/researchers-prove-rabbit-ai-breach-b...