https://avasam.pythonanywhere.com/global-scoreboard

On this leaderboard, the ID, which seems to have a purpose of being VERY private is actually visible to the public eye!

That's a User ID, not an API key. User IDs are publicly visible in the API, it's just a permanent unique identifier for a user. Doesn't give access to anything like an API key does.

@TheGaming100 I made this scoreboard, I appreciate the concern. The ID is something public you can easily obtain (for example, yours is here: speedrun.com/api/v1/users/TheGaming100 ). As far as the API key goes, it's never stored, and only used once in the login process, sent to speedrun.com's api over HTTPS to authenticate.