If it's accessible on the public internet and asks for something as secure as API keys, that is when you should worry about security, not when it's "meant to be picked up by HN".
Maybe if there was a service promised but not rendered, could you place full blame on the developer(s).