Delivery keys and why they are boring

A delivery key is read-only and only ever returns published entries. That is the whole feature, and the boringness is the point.

What it cannot do

It cannot write. It cannot delete. It cannot see drafts. If one leaks, an attacker gets content that was already on your public website.

What still deserves care

Scope is not a substitute for handling. Keep it out of client bundles anyway, rotate it if it escapes, and never let a management key anywhere near CI.