This repository is public. Keep all credentials and machine-specific secrets out of Git.

Never commit:

• Hermes bearer tokens.
• Cloudflare tunnel credentials.
• Android signing keys.
• Release keystore passwords.
• Local .env files.

Use environment variables for local debug defaults:

$env:HERMES_DEFAULT_URL='https://mobile.example.com'
$env:HERMES_DEFAULT_TOKEN='...'

Open a private GitHub issue for security concerns and avoid pasting live tokens into issue text.