Is it safe having keys exposed on the user account page?