Google API keys weren't secrets, but then Gemini changed the rules