The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.