It's not very secret, but it leaves them off the git repository, and they are obfuscated in the tar.xz, not directly in clear-text like before. This makes it more unlikely that other projects that fork of strawberry continue to use the same API credentials.

The tar.xz creation is automated through GitHub CI and attached to the release, the whole process is in the open. It's possible to compare the sha256 from the github actions job run log to the actual sha256 in the release on GitHub. There are plenty of projects that manually create and upload the source-code tarball. And I hope that Linux distros have learned from the xz backdoor and have better security to scan the code for security issues. AI has also come a long way since then.

I also think about this incident that could just as easily happen here, this has set us up for the same exact scenario: https://en.wikipedia.org/wiki/XZ_Utils_backdoor#:~:text=This modified file was not present in the git repository%3B it was only available from tar files