Leaked API keys are no longer unusual, nor are the breaches that follow. So why are sensitive tokens still being so easily ...