A security researcher disclosed that a hardcoded API key in ClickUp's production JavaScript bundle has exposed 959 email ...