This repository contains the stock radar, market scanners, backtests, paper-trading account, and review pages. It must not contain real portfolios, broker accounts, personal asset data, user/VIP account services, production databases, server credentials, chat identifiers, or deployment secrets.

• IWENCAI_API_KEY and optional LLM keys are read only from process environment variables.
• .env.example contains empty placeholders only.
• Local .env, databases, logs, generated pages, and key files are ignored by Git.
• Never paste a real key into an issue, pull request, test fixture, screenshot, or generated HTML.

If a credential is committed accidentally, revoke it first and then remove it from Git history. Deleting it only from the latest commit is not sufficient.

Please report security issues privately to the repository owner instead of opening a public issue with exploit details or credentials.