Randall Stillwell 0918bd0449 fix(security): stop leaking Gemini API key to browsers ... Delete the public /api/config/gemini endpoint and remove client auto-load paths so GEMINI_AI_API_KEY stays server-side only. Add a scan rate-limit class for the upcoming server-side identify route and a CI gate that blocks reintroducing config key leaks or new browser LLM URLs. Co-authored-by: Cursor <cursoragent@cursor.com>		2026-05-27 08:40:00 -05:00
..
workflows	fix(security): stop leaking Gemini API key to browsers	2026-05-27 08:40:00 -05:00
CODEOWNERS	refactor(auth): collapse lib/auth-context.js + lib/admin-auth.js onto lib/use-auth.js (#31)	2026-05-26 22:58:08 -05:00
PULL_REQUEST_TEMPLATE.md	bootstrap: agent pipeline v0.5.0 + ship-readiness review	2026-05-23 02:31:26 -05:00