There are some good answers here but I'll give a more old-school way this used to go down.
Your code would have something like ${env.api_key} in it.
Your build pipeline searches for those and replaces it with the correct value so your build artifact has the apikey built in, but what you check in does not.
I'm not sure the javascript way to facilitate that, but I'd be willing to bet someone already wrote something to do this.
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
There are some good answers here but I'll give a more old-school way this used to go down.
Your code would have something like ${env.api_key} in it.
Your build pipeline searches for those and replaces it with the correct value so your build artifact has the apikey built in, but what you check in does not.
I'm not sure the javascript way to facilitate that, but I'd be willing to bet someone already wrote something to do this.