Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, "src/module.ts" unconditionally merges all module options, including a configured cloud "api_key", into "runtimeConfig.public.ollama". Nuxt serializes this public configuration into the server-rendered HTML "window.__NUXT__" payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. "src/runtime/composables/useOllama.ts" also reads the public key and sends it as an "Authorization" "Bearer" credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.