SkyCast reads credentials from a local .env file. The browser never receives the OpenWeather key, optional data.gov.sg key, Redis URL, Sentry DSN, or VAPID private key, and Git ignores the real file.

1. Copy .env.example to .env.
2. Replace the placeholder with your OpenWeather API key.
3. Keep .env only on your computer.

For optional deployment settings, copy variable names from config/deployment.env.template and replace placeholders only inside .env or the hosting platform's secret store. Never place real values in the template.

Before committing, review git status --short and git diff --cached. The repository's pre-commit guard also rejects common secret files and credential patterns.

Deleting it in a later commit is not enough because it remains in Git history. Immediately revoke or rotate the key in the OpenWeather account, replace the local .env value, and clean the affected Git history before pushing again.

Never share credentials in screenshots, issue descriptions, chat messages, logs, or source files.

Web Push is disabled unless all VAPID settings are present. Only the public VAPID key is returned to the browser. Opted-in push endpoints, browser encryption keys, coordinates, and labels are stored in data/push_subscriptions.sqlite3, which is ignored by Git. Treat that database as sensitive operational data, restrict filesystem access, back it up only when necessary, and delete it when subscriptions are no longer needed.

Custom alert thresholds and quiet-hour settings are stored beside each opted-in subscription. Unsynced copies and general planner preferences remain in that browser's local storage. The alert-rules API identifies a browser by its existing encrypted push subscription; endpoint URLs are never placed in query strings or logs.

Use HTTPS in production and run scripts/send_weather_alerts.py from one trusted scheduler. The sender intentionally reports only aggregate counts and never logs endpoint URLs or subscription keys.

Sentry is initialized with default personally identifiable information collection disabled. Review organization retention and access controls before enabling it. Redis URLs commonly contain passwords; store REDIS_URL as a secret and use encrypted network transport when Redis is not on a trusted private network.

Every response receives an enforced Content Security Policy, anti-framing controls, nosniff, a restrictive permissions policy, and a strict-origin referrer policy. JavaScript is limited to SkyCast and pinned Leaflet; inline script attributes and eval are blocked. Inline style attributes remain narrowly allowed because canvas sizing and interactive chart/radar state are set dynamically. Update the CSP deliberately whenever a new external host is introduced.