We got an email from Google saying one of our API keys was available publicly. It had a link to a gist. The URL was bad but it linked to this Github account with over 5000 gists containing Lighthouse results:
https://gist.github.com/nathantanner/
Our API key is restricted to certain domains, the API usage on our end is pretty small (just geolocates new entries in a business directory).
Should I be concerned about this?