Use your own Gemini API key, device API key, management code and Wi-Fi credentials. The example configuration and .env.example contain placeholders only.

• Keep the Gemini key on the Raspberry Pi. Put only the device API key on the TF card.
• Never commit .env, /mindink/config.json, runtime settings, management codes, private certificates, vaults, recordings, SQLite databases or flash dumps.
• A public CA certificate may be shared; a private key must never be shared.
• Check screenshots and logs before posting them. Remove credentials and private notes.
• Use verified HTTPS for device access outside your trusted LAN. Keep the management interface on your private network.
• If a key is exposed, revoke or rotate it at its provider and update the device or server. Deleting a file from the latest commit does not remove it from Git history.

Before publishing changes, scan both staged files and history with Gitleaks:

gitleaks git . --log-opts=--all --redact
gitleaks git . --pre-commit --staged --redact

Report security problems privately through the repository's Security tab when private vulnerability reporting is available. Do not open a public issue containing credentials, recordings or unredacted diagnostics.