One thing worth remembering is that private fields don't automatically make secrets safe. # stops outside code from reading the field, but API keys still need proper handling outside the class too.