Leaked PostHog keys — analytics pipeline compromise

PostHog project keys are client-safe (like Sentry DSN); personal API tokens grant broader access. Distinguish the two before rotating.