Are you aware of what's clear in your Release bin?

[digitalarche]

I hope it's all fake, otherwise you really shouldn't put your release bin file in your repo. If once again it's not fake, revoke your key, but since then it must no longer be valid. Here's what we see in plain text and without using a binwalk or any other hacking software. Just NP++ ;)

GET /v2/users/jmt07/profile?api_key=8maxfwg5jhac8cqpz7lhp92n HTTP/1.1

For your information, but great job and effectively outdated with Etsy's API, which went to V3 last April.