leak: live WeatherAPI key committed in yasb/config.yaml #111

Finding

yasb/config.yaml has had a plaintext api_key for the weather widget committed since 62dc144 (2026-05-16):

weather:
    type: "yasb.weather.WeatherWidget"
    options:
      ...
      api_key: "222cdfe47c474d0c97d25040252206"

This is a real, usable WeatherAPI.com-style key (32-char hex) sitting in a public repo for over a month. Anyone can use it against your quota/account.

Fix

PR redacts the key to a placeholder with a comment pointing at where to get a free key:

api_key: "your_weatherapi_key" # set locally: get a free key at https://www.weatherapi.com/

Action needed from you

This key has been public — please rotate/revoke it at https://www.weatherapi.com/ (or whichever provider issued it) and set the new one locally (not committed).

Test plan

• Old key revoked/rotated
• New key set locally in yasb/config.yaml (uncommitted, or via local override) after pulling this fix
• grep -n api_key yasb/config.yaml shows only the placeholder