Seems more likely to me that the braze api key was exposed