These apps are local NFON API showcase demos. They are not a production gateway, identity provider, or hosted multi-tenant service.

docs/ is a static browser-only demo-data showcase. It must not contain API tokens, real tenants, real call records, real contacts, or hosted proxy credentials.

Real credentials must stay outside the repository, or in local-only .env, data/, or secrets/ paths that are never committed. This repository intentionally includes only .env.example files with empty or placeholder values.

Never commit:

• OAuth tokens.
• API keys or client secrets.
• Customer, contact, call, transcript, or tenant data from real environments.
• Local backup archives.

Run before sharing:

npm run secret-scan
git status --short --ignored

The apps can write runtime state under an external local config folder through *_DATA_DIR variables. Token and state files should be outside the repository, ignored by Git, and owner-readable only on local machines.

Report security issues to [email protected]. Do not include live credentials or real customer data in bug reports.

Before hosted or public operation, review deployment secrets, OAuth redirect registration, CORS origins, logging, rate limits, monitoring, and incident ownership.

GitHub Pages can host only the static demo-data showcase. Live API access requires the local Node.js apps, NFON-side CORS support, or a separately reviewed backend proxy.