Does Algolia enable referer restrictions by default on search-only API keys?

Algolia search-only API keys are created without HTTP referer restrictions unless explicitly configured. This opt-in model places the burden on developers to remember adding referer limits in the dashboard or via the Admin API. When omitted, the key can be used from any origin, potentially exposing index data or consuming quota if the key is extracted from client-side code. Secured API keys offer a server-side derivation path with embedded referer constraints, but they require additional implementation effort. The platform currently leaves referer restrictions disabled by default for new search-only keys, which differs from some other search platforms that enforce origin locking out of the box.

Does Algolia plan to change the default to enable referer restrictions on newly created search-only keys? What migration path would exist for existing keys if the default behavior changes? Which configuration approach—dashboard default, API parameter, or secured key derivation—best balances security and developer experience?