{"repo": "1966536805l-crypto/vantaapi-ranking", "files": {".env.example": {"b661cea5e1cb0005dd204115d2a6eedfbdefddc0": {"t": 1785747077.127366, "n": 3264, "h": "b5253094116dfec6", "c": "# JinMing Lab production launch env template.\n# Required production database: Postgres only. Do not use MySQL, SQLite, localhost, or a laptop database.\n# Use the pooled DATABASE_URL generated by Neon, Supabase, Vercel Postgres, or another managed Postgres provider.\nDATABASE_URL=\"postgresql://jinming_user:replace-with-strong-password@db.example.com:5432/jinming_lab?sslmode=require\"\nPOSTGRES_DB=\"jinming_lab\"\nPOSTGRES_USER=\"jinming_user\"\nPOSTGRES_PASSWORD=\"replace-with-strong-app-password\"\n\n# Required in production. Generate with: openssl rand -base64 48\nJWT_SECRET=\"replace-with-at-least-32-random-characters\"\n\n# Public registration should stay closed unless you deliberately open onboarding.\nENABLE_PUBLIC_REGISTRATION=\"false\"\n\n# Max 7 days. Enterprise baseline defaults to 24h.\nAUTH_SESSION_SECONDS=\"86400\"\n\n# Comma-separated canonical hosts accepted by proxy host-header guard.\n# Production: keep only canonical public hosts. Local dev may omit this variable or use 127.0.0.1:<port>.\nAPP_ALLOWED_HOSTS=\"vantaapi.com,www.vantaapi.com\"\n\n# Optional stable sitemap lastmod. Update on real content releases, not every request.\nSITEMAP_LASTMOD=\"2026-05-08T00:00:00.000Z\"\n\n# Edge protection mode. Keep normal for users. Switch to elevated or emergency during attacks.\nSECURITY_MODE=\"normal\"\n\n# Required for public launch if AI features are visible. Use a server-side provider key only; never expose it to the browser.\nAI_API_KEY=\"replace-with-server-side-ai-provider-token\"\nAI_BASE_URL=\"https://api.deepseek.com/v1\"\nAI_MODEL=\"deepseek-chat\"\nAI_TIMEOUT=\"12000\"\n\n# Recommended for public launch when GitHub Repo Analyzer is visible.\n# Use a least-privilege GitHub read token to raise public API quota.\nGITHUB_READ_TOKEN=\"replace-with-github-read-token\"\n\n# Optional self-hosted/local AI fallback. Works only when the Next.js server can reach Ollama.\n# For Vercel, keep this disabled unless OLLAMA_BASE_URL points to your own secured server.\nOLLAMA_ENABLED=\"false\"\nOLLAMA_BASE_URL=\"http://127.0.0.1:11434\"\nOLLAMA_MODEL=\"qwen2.5:3b\"\nOLLAMA_TIMEOUT=\"18000\"\nOLLAMA_API_KEY=\"\"\n\n# Optional low-friction bot protection for login/register only.\n# Production requires Turnstile by default; set both values before public launch.\nNEXT_PUBLIC_TURNSTILE_SITE_KEY=\"\"\nTURNSTILE_SECRET_KEY=\"\"\n\n# Optional, explicit seed-only admin initialization. No public default admin is created.\nSEED_ADMIN_EMAIL=\"\"\nSEED_ADMIN_PASSWORD=\"\"\nSEED_DEMO_USERS=\"false\"\nSEED_STUDENT_EMAIL=\"\"\nSEED_STUDENT_PASSWORD=\"\"\n\n# Production defaults to requiring Turnstile for login/register unless set to false intentionally.\nAUTH_TURNSTILE_REQUIRED=\"true\"\n\n# Recommended for public launch: set REDIS_URL to an Upstash or managed Redis URL.\n# Set true or provide REDIS_URL to enable distributed rate limits.\nENABLE_REDIS_RATE_LIMITS=\"true\"\nREDIS_RATE_LIMIT_FAIL_CLOSED=\"true\"\nREDIS_URL=\"\"\n\n# Required before enabling admin 2FA because TOTP secrets are encrypted at rest.\n# Generate with: openssl rand -hex 32\nENCRYPTION_KEY=\"replace-with-64-hex-chars\"\nCSRF_SECRET=\"replace-with-64-hex-chars\"\n\n# Keep true for production: admins without 2FA may only access the 2FA setup flow.\nADMIN_2FA_REQUIRED=\"true\"\n\n# C++ online runner must stay disabled unless moved to an isolated worker/sandbox.\nENABLE_CPP_RUNNER=\"false\"\n"}, "d602f5661727e14fe1d612c4ac6b980b5aec5433": {"t": 1785770272.2423623, "n": 3264, "h": "b5253094116dfec6", "c": "# JinMing Lab production launch env template.\n# Required production database: Postgres only. Do not use MySQL, SQLite, localhost, or a laptop database.\n# Use the pooled DATABASE_URL generated by Neon, Supabase, Vercel Postgres, or another managed Postgres provider.\nDATABASE_URL=\"postgresql://jinming_user:replace-with-strong-password@db.example.com:5432/jinming_lab?sslmode=require\"\nPOSTGRES_DB=\"jinming_lab\"\nPOSTGRES_USER=\"jinming_user\"\nPOSTGRES_PASSWORD=\"replace-with-strong-app-password\"\n\n# Required in production. Generate with: openssl rand -base64 48\nJWT_SECRET=\"replace-with-at-least-32-random-characters\"\n\n# Public registration should stay closed unless you deliberately open onboarding.\nENABLE_PUBLIC_REGISTRATION=\"false\"\n\n# Max 7 days. Enterprise baseline defaults to 24h.\nAUTH_SESSION_SECONDS=\"86400\"\n\n# Comma-separated canonical hosts accepted by proxy host-header guard.\n# Production: keep only canonical public hosts. Local dev may omit this variable or use 127.0.0.1:<port>.\nAPP_ALLOWED_HOSTS=\"vantaapi.com,www.vantaapi.com\"\n\n# Optional stable sitemap lastmod. Update on real content releases, not every request.\nSITEMAP_LASTMOD=\"2026-05-08T00:00:00.000Z\"\n\n# Edge protection mode. Keep normal for users. Switch to elevated or emergency during attacks.\nSECURITY_MODE=\"normal\"\n\n# Required for public launch if AI features are visible. Use a server-side provider key only; never expose it to the browser.\nAI_API_KEY=\"replace-with-server-side-ai-provider-token\"\nAI_BASE_URL=\"https://api.deepseek.com/v1\"\nAI_MODEL=\"deepseek-chat\"\nAI_TIMEOUT=\"12000\"\n\n# Recommended for public launch when GitHub Repo Analyzer is visible.\n# Use a least-privilege GitHub read token to raise public API quota.\nGITHUB_READ_TOKEN=\"replace-with-github-read-token\"\n\n# Optional self-hosted/local AI fallback. Works only when the Next.js server can reach Ollama.\n# For Vercel, keep this disabled unless OLLAMA_BASE_URL points to your own secured server.\nOLLAMA_ENABLED=\"false\"\nOLLAMA_BASE_URL=\"http://127.0.0.1:11434\"\nOLLAMA_MODEL=\"qwen2.5:3b\"\nOLLAMA_TIMEOUT=\"18000\"\nOLLAMA_API_KEY=\"\"\n\n# Optional low-friction bot protection for login/register only.\n# Production requires Turnstile by default; set both values before public launch.\nNEXT_PUBLIC_TURNSTILE_SITE_KEY=\"\"\nTURNSTILE_SECRET_KEY=\"\"\n\n# Optional, explicit seed-only admin initialization. No public default admin is created.\nSEED_ADMIN_EMAIL=\"\"\nSEED_ADMIN_PASSWORD=\"\"\nSEED_DEMO_USERS=\"false\"\nSEED_STUDENT_EMAIL=\"\"\nSEED_STUDENT_PASSWORD=\"\"\n\n# Production defaults to requiring Turnstile for login/register unless set to false intentionally.\nAUTH_TURNSTILE_REQUIRED=\"true\"\n\n# Recommended for public launch: set REDIS_URL to an Upstash or managed Redis URL.\n# Set true or provide REDIS_URL to enable distributed rate limits.\nENABLE_REDIS_RATE_LIMITS=\"true\"\nREDIS_RATE_LIMIT_FAIL_CLOSED=\"true\"\nREDIS_URL=\"\"\n\n# Required before enabling admin 2FA because TOTP secrets are encrypted at rest.\n# Generate with: openssl rand -hex 32\nENCRYPTION_KEY=\"replace-with-64-hex-chars\"\nCSRF_SECRET=\"replace-with-64-hex-chars\"\n\n# Keep true for production: admins without 2FA may only access the 2FA setup flow.\nADMIN_2FA_REQUIRED=\"true\"\n\n# C++ online runner must stay disabled unless moved to an isolated worker/sandbox.\nENABLE_CPP_RUNNER=\"false\"\n"}, "a4f467b33392d6a4e5e62079456dc5dd4a711567": {"t": 1785770273.7178009, "n": 3133, "h": "6f310d43ff605598", "c": "# JinMing Lab production launch env template.\n# Required production database: Postgres only. Do not use MySQL, SQLite, localhost, or a laptop database.\n# Use the pooled DATABASE_URL generated by Neon, Supabase, Vercel Postgres, or another managed Postgres provider.\nDATABASE_URL=\"postgresql://jinming_user:replace-with-strong-password@db.example.com:5432/jinming_lab?sslmode=require\"\nPOSTGRES_DB=\"jinming_lab\"\nPOSTGRES_USER=\"jinming_user\"\nPOSTGRES_PASSWORD=\"replace-with-strong-app-password\"\n\n# Required in production. Generate with: openssl rand -base64 48\nJWT_SECRET=\"replace-with-at-least-32-random-characters\"\n\n# Public registration should stay closed unless you deliberately open onboarding.\nENABLE_PUBLIC_REGISTRATION=\"false\"\n\n# Max 7 days. Enterprise baseline defaults to 24h.\nAUTH_SESSION_SECONDS=\"86400\"\n\n# Comma-separated canonical hosts accepted by proxy host-header guard.\n# Production: keep only canonical public hosts. Local dev may omit this variable or use 127.0.0.1:<port>.\nAPP_ALLOWED_HOSTS=\"vantaapi.com,www.vantaapi.com\"\n\n# Edge protection mode. Keep normal for users. Switch to elevated or emergency during attacks.\nSECURITY_MODE=\"normal\"\n\n# Required for public launch if AI features are visible. Use a server-side provider key only; never expose it to the browser.\nAI_API_KEY=\"replace-with-server-side-ai-provider-token\"\nAI_BASE_URL=\"https://api.deepseek.com/v1\"\nAI_MODEL=\"deepseek-chat\"\nAI_TIMEOUT=\"12000\"\n\n# Recommended for public launch when GitHub Repo Analyzer is visible.\n# Use a least-privilege GitHub read token to raise public API quota.\nGITHUB_READ_TOKEN=\"replace-with-github-read-token\"\n\n# Optional self-hosted/local AI fallback. Works only when the Next.js server can reach Ollama.\n# For Vercel, keep this disabled unless OLLAMA_BASE_URL points to your own secured server.\nOLLAMA_ENABLED=\"false\"\nOLLAMA_BASE_URL=\"http://127.0.0.1:11434\"\nOLLAMA_MODEL=\"qwen2.5:3b\"\nOLLAMA_TIMEOUT=\"18000\"\nOLLAMA_API_KEY=\"\"\n\n# Optional low-friction bot protection for login/register only.\n# Production requires Turnstile by default; set both values before public launch.\nNEXT_PUBLIC_TURNSTILE_SITE_KEY=\"\"\nTURNSTILE_SECRET_KEY=\"\"\n\n# Optional, explicit seed-only admin initialization. No public default admin is created.\nSEED_ADMIN_EMAIL=\"\"\nSEED_ADMIN_PASSWORD=\"\"\nSEED_DEMO_USERS=\"false\"\nSEED_STUDENT_EMAIL=\"\"\nSEED_STUDENT_PASSWORD=\"\"\n\n# Production defaults to requiring Turnstile for login/register unless set to false intentionally.\nAUTH_TURNSTILE_REQUIRED=\"true\"\n\n# Recommended for public launch: set REDIS_URL to an Upstash or managed Redis URL.\n# Set true or provide REDIS_URL to enable distributed rate limits.\nENABLE_REDIS_RATE_LIMITS=\"true\"\nREDIS_RATE_LIMIT_FAIL_CLOSED=\"true\"\nREDIS_URL=\"\"\n\n# Required before enabling admin 2FA because TOTP secrets are encrypted at rest.\n# Generate with: openssl rand -hex 32\nENCRYPTION_KEY=\"replace-with-64-hex-chars\"\nCSRF_SECRET=\"replace-with-64-hex-chars\"\n\n# Keep true for production: admins without 2FA may only access the 2FA setup flow.\nADMIN_2FA_REQUIRED=\"true\"\n\n# C++ online runner must stay disabled unless moved to an isolated worker/sandbox.\nENABLE_CPP_RUNNER=\"false\"\n"}, "7b0acb8e206eb449a07c9240c08457dedf28fef2": {"t": 1785770275.063081, "n": 2991, "h": "152588668527a079", "c": "# Production uses Postgres through Vercel/Neon.\n# Use the pooled DATABASE_URL generated by the Vercel Neon integration.\nDATABASE_URL=\"postgresql://vantaapi_user:replace-with-strong-password@db.example.com:5432/vantaapi?sslmode=require\"\nPOSTGRES_DB=\"vantaapi\"\nPOSTGRES_USER=\"vantaapi_user\"\nPOSTGRES_PASSWORD=\"replace-with-strong-app-password\"\n\n# Required in production. Generate with: openssl rand -base64 48\nJWT_SECRET=\"replace-with-at-least-32-random-characters\"\n\n# Public registration should stay closed unless you deliberately open onboarding.\nENABLE_PUBLIC_REGISTRATION=\"false\"\n\n# Max 7 days. Enterprise baseline defaults to 24h.\nAUTH_SESSION_SECONDS=\"86400\"\n\n# Comma-separated canonical hosts accepted by proxy host-header guard.\n# Production: keep only canonical public hosts. Local dev may omit this variable or use 127.0.0.1:<port>.\nAPP_ALLOWED_HOSTS=\"vantaapi.com,www.vantaapi.com\"\n\n# Edge protection mode. Keep normal for users. Switch to elevated or emergency during attacks.\nSECURITY_MODE=\"normal\"\n\n# Required for public launch if AI features are visible. Use a server-side provider key only; never expose it to the browser.\nAI_API_KEY=\"replace-with-server-side-ai-provider-token\"\nAI_BASE_URL=\"https://api.deepseek.com/v1\"\nAI_MODEL=\"deepseek-chat\"\nAI_TIMEOUT=\"12000\"\n\n# Required for public launch when GitHub Repo Analyzer is visible. Use a least-privilege read-only token.\nGITHUB_READ_TOKEN=\"replace-with-github-read-token\"\n\n# Optional self-hosted/local AI fallback. Works only when the Next.js server can reach Ollama.\n# For Vercel, keep this disabled unless OLLAMA_BASE_URL points to your own secured server.\nOLLAMA_ENABLED=\"false\"\nOLLAMA_BASE_URL=\"http://127.0.0.1:11434\"\nOLLAMA_MODEL=\"qwen2.5:3b\"\nOLLAMA_TIMEOUT=\"18000\"\nOLLAMA_API_KEY=\"\"\n\n# Optional low-friction bot protection for login/register only.\n# Production requires Turnstile by default; set both values before public launch.\nNEXT_PUBLIC_TURNSTILE_SITE_KEY=\"\"\nTURNSTILE_SECRET_KEY=\"\"\n\n# Redis for distributed production rate limits/audit pipelines.\nREDIS_HOST=\"127.0.0.1\"\nREDIS_PORT=\"6379\"\nREDIS_PASSWORD=\"\"\n\n# Optional, explicit seed-only admin initialization. No public default admin is created.\nSEED_ADMIN_EMAIL=\"\"\nSEED_ADMIN_PASSWORD=\"\"\nSEED_DEMO_USERS=\"false\"\nSEED_STUDENT_EMAIL=\"\"\nSEED_STUDENT_PASSWORD=\"\"\n\n# Production defaults to requiring Turnstile for login/register unless set to false intentionally.\nAUTH_TURNSTILE_REQUIRED=\"true\"\n\n# Set true or provide REDIS_URL to enable distributed rate limits.\nENABLE_REDIS_RATE_LIMITS=\"true\"\nREDIS_RATE_LIMIT_FAIL_CLOSED=\"true\"\nREDIS_URL=\"\"\n\n# Required before enabling admin 2FA because TOTP secrets are encrypted at rest.\n# Generate with: openssl rand -hex 32\nENCRYPTION_KEY=\"replace-with-64-hex-chars\"\nCSRF_SECRET=\"replace-with-64-hex-chars\"\n\n# Keep true for production: admins without 2FA may only access the 2FA setup flow.\nADMIN_2FA_REQUIRED=\"true\"\n\n# C++ online runner must stay disabled unless moved to an isolated worker/sandbox.\nENABLE_CPP_RUNNER=\"false\"\n"}, "320d7341dd60fba270e3ae85473061700f107515": {"t": 1785770276.6764328, "n": 2848, "h": "21ece10d86ea3533", "c": "# Production uses Postgres through Vercel/Neon.\n# Use the pooled DATABASE_URL generated by the Vercel Neon integration.\nDATABASE_URL=\"postgresql://vantaapi_user:replace-with-strong-password@db.example.com:5432/vantaapi?sslmode=require\"\nPOSTGRES_DB=\"vantaapi\"\nPOSTGRES_USER=\"vantaapi_user\"\nPOSTGRES_PASSWORD=\"replace-with-strong-app-password\"\n\n# Required in production. Generate with: openssl rand -base64 48\nJWT_SECRET=\"replace-with-at-least-32-random-characters\"\n\n# Public registration should stay closed unless you deliberately open onboarding.\nENABLE_PUBLIC_REGISTRATION=\"false\"\n\n# Max 7 days. Enterprise baseline defaults to 24h.\nAUTH_SESSION_SECONDS=\"86400\"\n\n# Comma-separated canonical hosts accepted by proxy host-header guard.\n# Production: keep only canonical public hosts. Local dev may omit this variable or use 127.0.0.1:<port>.\nAPP_ALLOWED_HOSTS=\"vantaapi.com,www.vantaapi.com\"\n\n# Edge protection mode. Keep normal for users. Switch to elevated or emergency during attacks.\nSECURITY_MODE=\"normal\"\n\n# Optional AI deep mode. Leave empty to use local instant tools and coaches only.\nAI_API_KEY=\"\"\nAI_BASE_URL=\"\"\nAI_MODEL=\"\"\nAI_TIMEOUT=\"12000\"\n\n# Optional deployer-side GitHub Repo Analyzer quota token. MVP still supports public repositories without user tokens.\nGITHUB_READ_TOKEN=\"\"\n\n# Optional self-hosted/local AI fallback. Works only when the Next.js server can reach Ollama.\n# For Vercel, keep this disabled unless OLLAMA_BASE_URL points to your own secured server.\nOLLAMA_ENABLED=\"false\"\nOLLAMA_BASE_URL=\"http://127.0.0.1:11434\"\nOLLAMA_MODEL=\"qwen2.5:3b\"\nOLLAMA_TIMEOUT=\"18000\"\nOLLAMA_API_KEY=\"\"\n\n# Optional low-friction bot protection for login/register only.\n# Production requires Turnstile by default; set both values before public launch.\nNEXT_PUBLIC_TURNSTILE_SITE_KEY=\"\"\nTURNSTILE_SECRET_KEY=\"\"\n\n# Redis for distributed production rate limits/audit pipelines.\nREDIS_HOST=\"127.0.0.1\"\nREDIS_PORT=\"6379\"\nREDIS_PASSWORD=\"\"\n\n# Optional, explicit seed-only admin initialization. No public default admin is created.\nSEED_ADMIN_EMAIL=\"\"\nSEED_ADMIN_PASSWORD=\"\"\nSEED_DEMO_USERS=\"false\"\nSEED_STUDENT_EMAIL=\"\"\nSEED_STUDENT_PASSWORD=\"\"\n\n# Production defaults to requiring Turnstile for login/register unless set to false intentionally.\nAUTH_TURNSTILE_REQUIRED=\"true\"\n\n# Set true or provide REDIS_URL to enable distributed rate limits.\nENABLE_REDIS_RATE_LIMITS=\"true\"\nREDIS_RATE_LIMIT_FAIL_CLOSED=\"true\"\nREDIS_URL=\"\"\n\n# Required before enabling admin 2FA because TOTP secrets are encrypted at rest.\n# Generate with: openssl rand -hex 32\nENCRYPTION_KEY=\"replace-with-64-hex-chars\"\nCSRF_SECRET=\"replace-with-64-hex-chars\"\n\n# Keep true for production: admins without 2FA may only access the 2FA setup flow.\nADMIN_2FA_REQUIRED=\"true\"\n\n# C++ online runner must stay disabled unless moved to an isolated worker/sandbox.\nENABLE_CPP_RUNNER=\"false\"\n"}, "e00de0d34a689a85db72fbe6c5a3c68345f8c43c": {"t": 1785770278.0089016, "n": 2894, "h": "8b7c01f9eeda38f4", "c": "# Production currently uses MySQL/MariaDB through Prisma.\n# Use a least-privilege database user; do not expose port 3306 publicly.\nDATABASE_URL=\"mysql://vantaapi_user:replace-with-strong-password@127.0.0.1:3306/vantaapi\"\nMARIADB_ROOT_PASSWORD=\"replace-with-strong-root-password\"\nMARIADB_DATABASE=\"vantaapi\"\nMARIADB_USER=\"vantaapi_user\"\nMARIADB_PASSWORD=\"replace-with-strong-app-password\"\n\n# Required in production. Generate with: openssl rand -base64 48\nJWT_SECRET=\"replace-with-at-least-32-random-characters\"\n\n# Public registration should stay closed unless you deliberately open onboarding.\nENABLE_PUBLIC_REGISTRATION=\"false\"\n\n# Max 7 days. Enterprise baseline defaults to 24h.\nAUTH_SESSION_SECONDS=\"86400\"\n\n# Comma-separated canonical hosts accepted by proxy host-header guard.\n# Production: keep only canonical public hosts. Local dev may omit this variable or use 127.0.0.1:<port>.\nAPP_ALLOWED_HOSTS=\"vantaapi.com,www.vantaapi.com\"\n\n# Edge protection mode. Keep normal for users. Switch to elevated or emergency during attacks.\nSECURITY_MODE=\"normal\"\n\n# Optional AI deep mode. Leave empty to use local instant tools and coaches only.\nAI_API_KEY=\"\"\nAI_BASE_URL=\"\"\nAI_MODEL=\"\"\nAI_TIMEOUT=\"12000\"\n\n# Optional deployer-side GitHub Repo Analyzer quota token. MVP still supports public repositories without user tokens.\nGITHUB_READ_TOKEN=\"\"\n\n# Optional self-hosted/local AI fallback. Works only when the Next.js server can reach Ollama.\n# For Vercel, keep this disabled unless OLLAMA_BASE_URL points to your own secured server.\nOLLAMA_ENABLED=\"false\"\nOLLAMA_BASE_URL=\"http://127.0.0.1:11434\"\nOLLAMA_MODEL=\"qwen2.5:3b\"\nOLLAMA_TIMEOUT=\"18000\"\nOLLAMA_API_KEY=\"\"\n\n# Optional low-friction bot protection for login/register only.\n# Production requires Turnstile by default; set both values before public launch.\nNEXT_PUBLIC_TURNSTILE_SITE_KEY=\"\"\nTURNSTILE_SECRET_KEY=\"\"\n\n# Redis for distributed production rate limits/audit pipelines.\nREDIS_HOST=\"127.0.0.1\"\nREDIS_PORT=\"6379\"\nREDIS_PASSWORD=\"\"\n\n# Optional, explicit seed-only admin initialization. No public default admin is created.\nSEED_ADMIN_EMAIL=\"\"\nSEED_ADMIN_PASSWORD=\"\"\nSEED_DEMO_USERS=\"false\"\nSEED_STUDENT_EMAIL=\"\"\nSEED_STUDENT_PASSWORD=\"\"\n\n# Production defaults to requiring Turnstile for login/register unless set to false intentionally.\nAUTH_TURNSTILE_REQUIRED=\"true\"\n\n# Set true or provide REDIS_URL to enable distributed rate limits.\nENABLE_REDIS_RATE_LIMITS=\"true\"\nREDIS_RATE_LIMIT_FAIL_CLOSED=\"true\"\nREDIS_URL=\"\"\n\n# Required before enabling admin 2FA because TOTP secrets are encrypted at rest.\n# Generate with: openssl rand -hex 32\nENCRYPTION_KEY=\"replace-with-64-hex-chars\"\nCSRF_SECRET=\"replace-with-64-hex-chars\"\n\n# Keep true for production: admins without 2FA may only access the 2FA setup flow.\nADMIN_2FA_REQUIRED=\"true\"\n\n# C++ online runner must stay disabled unless moved to an isolated worker/sandbox.\nENABLE_CPP_RUNNER=\"false\"\n"}, "47a31367e51e4c3948c7a14cbbe13d7298554c6b": {"t": 1785770279.2178285, "n": 2753, "h": "d14a1c9bd3a511c2", "c": "# Production currently uses MySQL/MariaDB through Prisma.\n# Use a least-privilege database user; do not expose port 3306 publicly.\nDATABASE_URL=\"mysql://vantaapi_user:replace-with-strong-password@127.0.0.1:3306/vantaapi\"\nMARIADB_ROOT_PASSWORD=\"replace-with-strong-root-password\"\nMARIADB_DATABASE=\"vantaapi\"\nMARIADB_USER=\"vantaapi_user\"\nMARIADB_PASSWORD=\"replace-with-strong-app-password\"\n\n# Required in production. Generate with: openssl rand -base64 48\nJWT_SECRET=\"replace-with-at-least-32-random-characters\"\n\n# Public registration should stay closed unless you deliberately open onboarding.\nENABLE_PUBLIC_REGISTRATION=\"false\"\n\n# Max 7 days. Enterprise baseline defaults to 24h.\nAUTH_SESSION_SECONDS=\"86400\"\n\n# Comma-separated canonical hosts accepted by proxy host-header guard.\n# Production: keep only canonical public hosts. Local dev may omit this variable or use 127.0.0.1:<port>.\nAPP_ALLOWED_HOSTS=\"vantaapi.com,www.vantaapi.com\"\n\n# Edge protection mode. Keep normal for users. Switch to elevated or emergency during attacks.\nSECURITY_MODE=\"normal\"\n\n# Optional AI deep mode. Leave empty to use local instant tools and coaches only.\nAI_API_KEY=\"\"\nAI_BASE_URL=\"\"\nAI_MODEL=\"\"\nAI_TIMEOUT=\"12000\"\n\n# Optional self-hosted/local AI fallback. Works only when the Next.js server can reach Ollama.\n# For Vercel, keep this disabled unless OLLAMA_BASE_URL points to your own secured server.\nOLLAMA_ENABLED=\"false\"\nOLLAMA_BASE_URL=\"http://127.0.0.1:11434\"\nOLLAMA_MODEL=\"qwen2.5:3b\"\nOLLAMA_TIMEOUT=\"18000\"\nOLLAMA_API_KEY=\"\"\n\n# Optional low-friction bot protection for login/register only.\n# Production requires Turnstile by default; set both values before public launch.\nNEXT_PUBLIC_TURNSTILE_SITE_KEY=\"\"\nTURNSTILE_SECRET_KEY=\"\"\n\n# Redis for distributed production rate limits/audit pipelines.\nREDIS_HOST=\"127.0.0.1\"\nREDIS_PORT=\"6379\"\nREDIS_PASSWORD=\"\"\n\n# Optional, explicit seed-only admin initialization. No public default admin is created.\nSEED_ADMIN_EMAIL=\"\"\nSEED_ADMIN_PASSWORD=\"\"\nSEED_DEMO_USERS=\"false\"\nSEED_STUDENT_EMAIL=\"\"\nSEED_STUDENT_PASSWORD=\"\"\n\n# Production defaults to requiring Turnstile for login/register unless set to false intentionally.\nAUTH_TURNSTILE_REQUIRED=\"true\"\n\n# Set true or provide REDIS_URL to enable distributed rate limits.\nENABLE_REDIS_RATE_LIMITS=\"true\"\nREDIS_RATE_LIMIT_FAIL_CLOSED=\"true\"\nREDIS_URL=\"\"\n\n# Required before enabling admin 2FA because TOTP secrets are encrypted at rest.\n# Generate with: openssl rand -hex 32\nENCRYPTION_KEY=\"replace-with-64-hex-chars\"\nCSRF_SECRET=\"replace-with-64-hex-chars\"\n\n# Keep true for production: admins without 2FA may only access the 2FA setup flow.\nADMIN_2FA_REQUIRED=\"true\"\n\n# C++ online runner must stay disabled unless moved to an isolated worker/sandbox.\nENABLE_CPP_RUNNER=\"false\"\n"}, "53ac19fa2ad258c21fabb975c717a7fb18c8510d": {"t": 1785770280.5784235, "n": 2634, "h": "2838fd6f8252fadd", "c": "# Production currently uses MySQL/MariaDB through Prisma.\n# Use a least-privilege database user; do not expose port 3306 publicly.\nDATABASE_URL=\"mysql://vantaapi_user:replace-with-strong-password@127.0.0.1:3306/vantaapi\"\nMARIADB_ROOT_PASSWORD=\"replace-with-strong-root-password\"\nMARIADB_DATABASE=\"vantaapi\"\nMARIADB_USER=\"vantaapi_user\"\nMARIADB_PASSWORD=\"replace-with-strong-app-password\"\n\n# Required in production. Generate with: openssl rand -base64 48\nJWT_SECRET=\"replace-with-at-least-32-random-characters\"\n\n# Public registration should stay closed unless you deliberately open onboarding.\nENABLE_PUBLIC_REGISTRATION=\"false\"\n\n# Max 7 days. Enterprise baseline defaults to 24h.\nAUTH_SESSION_SECONDS=\"86400\"\n\n# Comma-separated canonical hosts accepted by proxy host-header guard.\n# Production: keep only canonical public hosts. Local dev may omit this variable or use 127.0.0.1:<port>.\nAPP_ALLOWED_HOSTS=\"vantaapi.com,www.vantaapi.com\"\n\n# Optional AI deep mode. Leave empty to use local instant tools and coaches only.\nAI_API_KEY=\"\"\nAI_BASE_URL=\"\"\nAI_MODEL=\"\"\nAI_TIMEOUT=\"12000\"\n\n# Optional self-hosted/local AI fallback. Works only when the Next.js server can reach Ollama.\n# For Vercel, keep this disabled unless OLLAMA_BASE_URL points to your own secured server.\nOLLAMA_ENABLED=\"false\"\nOLLAMA_BASE_URL=\"http://127.0.0.1:11434\"\nOLLAMA_MODEL=\"qwen2.5:3b\"\nOLLAMA_TIMEOUT=\"18000\"\nOLLAMA_API_KEY=\"\"\n\n# Optional low-friction bot protection for login/register only.\n# Production requires Turnstile by default; set both values before public launch.\nNEXT_PUBLIC_TURNSTILE_SITE_KEY=\"\"\nTURNSTILE_SECRET_KEY=\"\"\n\n# Redis for distributed production rate limits/audit pipelines.\nREDIS_HOST=\"127.0.0.1\"\nREDIS_PORT=\"6379\"\nREDIS_PASSWORD=\"\"\n\n# Optional, explicit seed-only admin initialization. No public default admin is created.\nSEED_ADMIN_EMAIL=\"\"\nSEED_ADMIN_PASSWORD=\"\"\nSEED_DEMO_USERS=\"false\"\nSEED_STUDENT_EMAIL=\"\"\nSEED_STUDENT_PASSWORD=\"\"\n\n# Production defaults to requiring Turnstile for login/register unless set to false intentionally.\nAUTH_TURNSTILE_REQUIRED=\"true\"\n\n# Set true or provide REDIS_URL to enable distributed rate limits.\nENABLE_REDIS_RATE_LIMITS=\"true\"\nREDIS_RATE_LIMIT_FAIL_CLOSED=\"true\"\nREDIS_URL=\"\"\n\n# Required before enabling admin 2FA because TOTP secrets are encrypted at rest.\n# Generate with: openssl rand -hex 32\nENCRYPTION_KEY=\"replace-with-64-hex-chars\"\nCSRF_SECRET=\"replace-with-64-hex-chars\"\n\n# Keep true for production: admins without 2FA may only access the 2FA setup flow.\nADMIN_2FA_REQUIRED=\"true\"\n\n# C++ online runner must stay disabled unless moved to an isolated worker/sandbox.\nENABLE_CPP_RUNNER=\"false\"\n"}, "4691e284d43262db0f8cc7004c31b7d1929489e4": {"t": 1785770282.109712, "n": 2316, "h": "8b11979e711df668", "c": "# Production currently uses MySQL/MariaDB through Prisma.\n# Use a least-privilege database user; do not expose port 3306 publicly.\nDATABASE_URL=\"mysql://vantaapi_user:replace-with-strong-password@127.0.0.1:3306/vantaapi\"\nMARIADB_ROOT_PASSWORD=\"replace-with-strong-root-password\"\nMARIADB_DATABASE=\"vantaapi\"\nMARIADB_USER=\"vantaapi_user\"\nMARIADB_PASSWORD=\"replace-with-strong-app-password\"\n\n# Required in production. Generate with: openssl rand -base64 48\nJWT_SECRET=\"replace-with-at-least-32-random-characters\"\n\n# Public registration should stay closed unless you deliberately open onboarding.\nENABLE_PUBLIC_REGISTRATION=\"false\"\n\n# Max 7 days. Enterprise baseline defaults to 24h.\nAUTH_SESSION_SECONDS=\"86400\"\n\n# Comma-separated canonical hosts accepted by proxy host-header guard.\n# Production: keep only canonical public hosts. Local dev may omit this variable or use 127.0.0.1:<port>.\nAPP_ALLOWED_HOSTS=\"vantaapi.com,www.vantaapi.com\"\n\n# Optional AI deep mode. Leave empty to use local instant tools and coaches only.\nAI_API_KEY=\"\"\nAI_BASE_URL=\"\"\nAI_MODEL=\"\"\nAI_TIMEOUT=\"12000\"\n\n# Optional low-friction bot protection for login/register only.\n# Production requires Turnstile by default; set both values before public launch.\nNEXT_PUBLIC_TURNSTILE_SITE_KEY=\"\"\nTURNSTILE_SECRET_KEY=\"\"\n\n# Redis for distributed production rate limits/audit pipelines.\nREDIS_HOST=\"127.0.0.1\"\nREDIS_PORT=\"6379\"\nREDIS_PASSWORD=\"\"\n\n# Optional, explicit seed-only admin initialization. No public default admin is created.\nSEED_ADMIN_EMAIL=\"\"\nSEED_ADMIN_PASSWORD=\"\"\nSEED_DEMO_USERS=\"false\"\nSEED_STUDENT_EMAIL=\"\"\nSEED_STUDENT_PASSWORD=\"\"\n\n# Production defaults to requiring Turnstile for login/register unless set to false intentionally.\nAUTH_TURNSTILE_REQUIRED=\"true\"\n\n# Set true or provide REDIS_URL to enable distributed rate limits.\nENABLE_REDIS_RATE_LIMITS=\"true\"\nREDIS_RATE_LIMIT_FAIL_CLOSED=\"true\"\nREDIS_URL=\"\"\n\n# Required before enabling admin 2FA because TOTP secrets are encrypted at rest.\n# Generate with: openssl rand -hex 32\nENCRYPTION_KEY=\"replace-with-64-hex-chars\"\nCSRF_SECRET=\"replace-with-64-hex-chars\"\n\n# Keep true for production: admins without 2FA may only access the 2FA setup flow.\nADMIN_2FA_REQUIRED=\"true\"\n\n# C++ online runner must stay disabled unless moved to an isolated worker/sandbox.\nENABLE_CPP_RUNNER=\"false\"\n"}}}}