This is not a secret (it's sent to the client as part of the JS anyway) so it's not a big deal that it was on the public repository but it's still better to have it be configurable.