I had a similar experience yesterday with Argon (in Antigravity), but unfortunately it didn't come up until I explicitly asked it for a security audit. It had previously stored a secret API key in plain text [because it thought it made local testing easier], and didn't warn me before I'd committed to GitHub and deployed to Vercel. So, 50/50 but I've still added a note in a skill file to never do this again.