This public repository was created from private frontend/backend/website repositories using a fresh Git history. The original private history was not reused because removing secrets from the current file tree would not remove them from old commits.

• Local .env files.
• Supabase anon/service-role values from local Spring config.
• PostgreSQL host/user/password values.
• Firebase service account JSON files.
• Live Firebase web config and project identifiers.
• Google Maps and Brave Search keys.
• Viator, Geoapify, Unsplash, Beehiiv, and Travelpayouts keys/tokens.
• Firebase Hosting GitHub Actions workflow connected to the live project.
• Flutter native shells that contained old mobile-specific Google Maps config.
• IDE and local agent settings.
• Build artifacts such as build/, .dart_tool/, .next/, node_modules/, and target/.

If you deploy your own fork:

• Restrict browser API keys by domain and API surface.
• Keep Supabase service-role keys server-side only.
• Enable RLS in Supabase and mirror backend ownership checks.
• Do not expose actuator env, configprops, heap dump, thread dump, or shutdown endpoints.
• Rotate any credentials that were ever present in a private repo before making that repo public.
• Prefer a new public repo with clean history over changing visibility on a previously private repo.

The repository includes placeholder config only. Run this before pushing changes:

rg -n --hidden -S "(AIza|BEGIN PRIVATE KEY|private_key|service_role|DATABASE_PASSWORD=|SUPABASE_SERVICE_ROLE_KEY=|TRAVELPAYOUTS_API_TOKEN=)" .