How a Leaked Translation Key Forced Me to Rethink WordPress Security

The incident report landed in my inbox at 2 AM: unexpected API usage from Eastern Europe. Not a brute-force attack, not a plugin vulnerability, just a translation API key, quietly exfiltrating product descriptions for a week before finance flagged the $1,200 invoice. The key had been pasted into a s