This repository is prepared so it can be shared without runtime secrets or local data.

Do not commit .env, API keys, JWT secrets, local databases, logs, uploaded files, or local vector-store data.

The project uses .env.example as a template only. Before running the app, copy it to .env and fill it with your own values.

• Rotate any API key that was ever stored locally in .env.
• Confirm .env, Data/, local_data/, temp_uploads/, system.log, and private sample documents are ignored by git.
• Review frontend config before deployment and avoid hardcoded API keys in browser JavaScript.
• Use a strong JWT_SECRET_KEY in production.
• Restrict CORS_ORIGINS to trusted domains.