@tebriel
Do you have a better suggestion? The only other alternative as far as I can see is to have every user create their own, and that would cause hassle for a lot of users.
It's not very secret, but it leaves them off the git repository, and they are obfuscated in the tar.xz, not directly in clear-text like before. This makes it more unlikely that other projects that fork of strawberry continue to use the same API credentials.
The tar.xz creation is automated through GitHub CI and attached to the release, the whole process is in the open. It's possible to compare the sha256 from the github actions job run log to the actual sha256 in the release on GitHub. There are plenty of projects that manually create and upload the source-code tarball. And I hope that Linux distros have learned from the xz backdoor and have better security to scan the code for security issues. AI has also come a long way since then.