example.env

DEEPSEEK_API_KEY=replace-with-your-deepseek-key
# Generate one per trusted backend with: openssl rand -hex 32
# Comma-separated tokens allow rotation; never ship these in browser extensions.
SCAMSHIELD_API_KEYS=
REDIS_URL=redis://localhost:6379/0
MAX_REQUEST_LIMIT=10
RATE_LIMIT_WINDOW=60
MAX_FILE_SIZE=26214400
MAX_AUDIO_SECONDS=120
WHISPER_MODEL=turbo
PRELOAD_WHISPER=false


# Allowed browser origins (comma-separated).
# Local development: http://localhost:5173
# Production: https://scamshield.click,https://docs.scamshield.click
# Set CORS_ORIGINS to the production list when deploying. Wildcards are rejected.
# If unset or empty, no cross-origin browser access is allowed. Restart after changes.
CORS_ORIGINS=http://localhost:5173