If the API key has some certain permissions I don't see any exploitation risk. In the end, Vue.js or any other HTML is basically a GUI for REST API. You should always limit your REST API operations on server-side and don't trust frontend validations. Power users are always able to access your sessions,cookies,tokens and can use them freely with API.
Fundamentals: Ten Keys to Reality by Frank Wilczek
Great intro to particle physics even for an ordinary, non-science person.
Blew my head by the very basics of reality is literally a simple formula. Like a codebase.
