Randall Stillwell 0918bd0449 fix(security): stop leaking Gemini API key to browsers ... Delete the public /api/config/gemini endpoint and remove client auto-load paths so GEMINI_AI_API_KEY stays server-side only. Add a scan rate-limit class for the upcoming server-side identify route and a CI gate that blocks reintroducing config key leaks or new browser LLM URLs. Co-authored-by: Cursor <cursoragent@cursor.com>		2026-05-27 08:40:00 -05:00
..
api-routes.mdc	fix(security): stop leaking Gemini API key to browsers	2026-05-27 08:40:00 -05:00
auth-and-permissions.mdc	refactor(auth): collapse lib/auth-context.js + lib/admin-auth.js onto lib/use-auth.js (#31)	2026-05-26 22:58:08 -05:00
db-and-schema.mdc	feat(infra): adopt node-pg-migrate + backfill initial schema migration (#32)	2026-05-26 23:01:58 -05:00
no-go-zones.mdc	feat(infra): adopt node-pg-migrate + backfill initial schema migration (#32)	2026-05-26 23:01:58 -05:00
schema-map.mdc	bootstrap: agent pipeline v0.5.0 + ship-readiness review	2026-05-23 02:31:26 -05:00
ui-and-theming.mdc	feat(brand): unify on Deck Hearth across in-repo strings + infra (P1 brand decision)	2026-05-25 02:28:29 -05:00