# Local development .env — DO NOT COMMIT production secrets here.
# For production, copy .env.sample and modify accordingly.

SECRET_KEY=aQrG1gg1piaGmo6zVVxvQguNV9avrXLAIoD5Sy1JU99Pr1rneBBo8x0FA6CQRoH4
CORS_ORIGINS=http://154.217.250.206,http://127.0.0.1:7000,http://127.0.0.1:7070,http://localhost:7000,http://localhost:5173
ACCESS_TOKEN_EXPIRE_MINUTES=120
RATE_LIMIT=200/minute
# Login endpoint rate limit (per IP / minute, brute-force protection)
AUTH_RATE_LIMIT=5/minute
# Exploit server public URL (optional; auto-uses request Host header if empty)
DARKSWORD_PUBLIC_BASE=http://127.0.0.1:7070
# Exploit redirect URL (optional)
# EXPLOIT_REDIRECT=https://example.com
