fix(security): restrict settings.json permissions and stop caching the raw apiKey

fix(security): restrict settings.json permissions and stop caching the raw apiKey #580