Security Feature Request - Disallow Uploading of pcconfig.json with API Key

[Christopher-Hayes]

By default, if you have a pcconfig.json in your target directory, playcanvas-sync will want to upload that file when you run pcsync pushAll. You can also keep your API key inside that config file. If that happens, the user will be making their API key available to the world when the project is deployed.

I do like the idea of keeping the pcconfig.json paired with a project for consistency across development environments. So, instead of disabling the uploading of pcconfig.json all together, it would be nice if playcanvas-sync had a special case where it checks pcconfig.json for the API key property before it uploads.

I embarrassingly made this mistake, and I know PlayCanvas has a lot of younger users. So, getting ahead of this might be a good idea.