An initial public revision contained a private-key-shaped value in .env.example. Removing it from the latest tree does not remove it from Git history.

On 22 July 2026, the active local backend/.env was sanitized: the raw private-key field and all live KeeperHub credentials were removed. Its replacement defaults to explicit demo mode. This prevents accidental local reuse but cannot revoke the old wallet or erase remote Git history.

Before any further live execution:

1. Treat the affected key as permanently compromised.
2. Move any remaining assets to a newly provisioned KeeperHub/Turnkey wallet.
3. Revoke or replace the associated KeeperHub wallet integration and API keys.
4. Purge the value from all Git refs with an appropriate history-rewrite tool.
5. Force-push only after coordinating the rewrite, then ask existing clones/forks to be deleted or recloned.
6. Run a secret scanner across the complete history.

Production startup now requires distinct gate and admin tokens. npm run submit:check scans the current tracked tree for private-key-shaped assignments.

Run npm run setup:secure to sanitize backend/.env and generate new local KeeperGate access tokens. This is local token rotation only; revoke and recreate KeeperHub/Turnkey credentials in their own control panels.

Do not reuse the old wallet even if its balance is currently zero. This repository intentionally contains no private-key fallback: KeeperHub remains the signer.

Open a private security advisory on the GitHub repository. Do not include credentials, mnemonics, or live exploit details in a public issue.