> in the event of bugs or security vulnerabilities in your application

The article talks about keys being published as part of the web page configuration.

That's far worse than "they could hack a server and gain its credentials!"