Morning Signal is designed to be safe to demo publicly in DEMO_MODE=true. Live mode requires provider credentials and should be handled carefully.

Never commit:

• .env
• .env.*
• provider API keys
• local database files
• exported logs containing secrets

Use hosting-provider environment variables for live deployments.

The public Vercel deployment should run with:

DEMO_MODE=true

In demo mode, the app uses deterministic fixtures and does not require Nimble or OpenAI secrets.

Live mode requires:

NIMBLE_API_KEY=
OPENAI_API_KEY=

Keep these values server-side only. They must never be sent to the browser.

Company discovery validates public HTTP/HTTPS URLs and rejects private/local hosts. Keep this protection if you extend the app to fetch arbitrary URLs.

Newsletter delivery uses an allowlist through:

NEWSLETTER_ALLOWED_RECIPIENTS=

Do not remove the allowlist unless you add authentication, abuse prevention, and rate limiting.

If you find a security issue, do not open a public issue with sensitive details. Contact the repository owner privately.