Rust env!() macro bakes API keys into desktop release builds

A developer found that Rust's env!() macro inlines environment variables into the binary at compile time, leaving CI API keys embedded in shipped release builds. Repository-level secret scanners miss the leak because they only inspect source code, and the AI decompiler Claude recovered the keys from the binary in under an hour.

• Rust env!() inlines environment variables into the binary at compile time
• CI secret scanners check source code, not compiled artifacts
• Claude reconstructed the embedded API keys in about an hour
• Secrets should be fetched from a vault at runtime instead of via env!()