This public demo is designed to be safe to publish.

• .env
• OAuth client secret files
• OAuth token files
• API keys
• refresh tokens
• logs with real account data
• private screenshots
• real channel exports
• internal network hostnames
• private IP addresses

Run this from the project root:

rg -n "192\.168\.|10\.|172\.|gmail|token|secret|client_secret|refresh_token|password|private|ssh|api_key|oauth|stuar|proxcee"

Every match must be reviewed.

Public sample data must be fake.

Do not use real:

• channel IDs
• video IDs
• analytics snapshots
• subscriber counts
• upload metadata
• internal URLs

If this becomes a paid pack, users should create and own their own Google OAuth credentials.

Do not ship shared credentials.

The public container must contain only the static dashboard, logo assets, and synthetic embedded data. Do not copy .env, configuration secrets, sample-data exports, scripts, logs, documentation working files, or Git metadata into the image.

The .dockerignore file enforces this boundary. Review it whenever the Docker build context changes.