should `privkey1.pem` be committed in the repo?

[Mitchellja13]

Bug Report

Describe the Bug
I noticed that the repo includes a tracked private key file, privkey1.pem, alongside fullchain1.pem.

I may be missing some project-specific reason this is intentional, but it stood out because index.js appears to load that key directly when starting the local HTTPS server on port 3001:

var httpsOptions = {
  key: fs.readFileSync(path.join(__dirname, 'privkey1.pem')),
  cert: fs.readFileSync(path.join(__dirname, 'fullchain1.pem'))
}

If this is only a throwaway/local development certificate, then maybe it is expected. But since the private key is public in the repository, it seems like it should be treated as compromised and not reused anywhere sensitive. Or atleast stated as a note incase anybody for some reason plans to serve the repo externally in their env.

Steps to Reproduce

1. Clone the repo.
2. See that privkey1.pem and fullchain1.pem are included.
3. Open index.js.
4. Confirm that the HTTPS server reads those files directly.

Expected Behavior
I would usually expect private keys to be excluded from the repo, even for local HTTPS.

A possible alternative could be to generate a local development certificate during setup, allow certificate paths to be configured through environment variables/settings, or fall back to HTTP for local use if HTTPS is not strictly required.

Screenshots / Screen Recordings
Not applicable.

Additional Context
Mostly opening this to ask whether this is intentional or an oversight. If the key has ever been used for a real certificate/domain, it may need to be revoked/replaced.