You're sharing a perfectly valid opinion that I happen to agree with. However, you did so in reply to a very specific question — someone asking why jacquesm (a well-known poster on HN) — considers the actions described in the article a data breach rather than merely security testing. Your comment had nothing to do with that. That's all!
My point was to say how AI tools can quickly build insecure software systems.
Am I wrong that shipping a key publicly in the client side is not something a tool should try to check for?