In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.Referenceshttps://zulip.readthedocs.io/en/2.1.7/overview/changelog.html#id35
