The DonutSMP API key stays on the server and is never sent to the browser.
Website requests pass through a controlled backend proxy with input validation and a five-second cooldown.
Unavailable or delayed data is labelled honestly. The website does not invent statistics when the upstream API cannot provide them.