As for the exposed AWS API key, it's part of the PDF download URL for
one of the papers in the bibliography. So it's not our key and we can't
do much about it (except maybe shorten the URL to hide it).