- [API key at-rest model](threat-model-apikey.md) — how LexAI stores/migrates the BYO LLM key and what "secure" does and doesn't mean here