I just learned something. the Vision assistant plugin, like so many others, sure, it hides the API key in the *settings* screen, but it's stored in *plain* text in nvda.ini. that's how it's able to show it to you when you check the show API key checkbox. I've removed the plugin, reported the issue, and thanks to @FreakyFwoof's NVDA sync plugin my INI's clean. Damn developers, do better where you store your API keys sweet fucking jesus.