Security Notes

Admin Access

ADMIN_DIRECT_ACCESS="true" bypasses the login form. It is useful for local experiments only.

For any public deployment:

ADMIN_DIRECT_ACCESS="false"

If direct access is enabled publicly, anyone who can open the site can reach admin pages and admin APIs.

Prefer ADMIN_PASSWORD_HASH in production. Generate it locally:

npm run auth:hash

Avoid committing .env; the repository ignores .env* except .env.example.

AI provider keys spend real money or quota. The public chat routes use database-backed rate limiting:

Watch /admin/chats and the admin dashboard usage cards after launch.

The admin environment form is for local development. The API refuses to write .env when NODE_ENV="production".

Posts and moments are admin-only, but Markdown content still renders in the browser. Keep dependencies updated and review renderer changes carefully.

If you publish this template, add your own security contact in the README or repository settings.