The original committed the Foursquare API key to client JS, the way the assignment was taught. For the museum-ready branch, the key was redacted and getFoursquare() early-returns an empty list so the business-search button no-ops gracefully; the geolocation pin and tile layer still work. The original branch retains the historical commit. A 3s geolocation timeout falls back to Las Vegas coordinates when the sandboxed iframe blocks the browser prompt.