Qwen 3.8 invents URLs with real key ID, that's why I think it's no backdoor