- config.json now in .gitignore — it contained admin password hash and
secret_key placeholder which should never be in version control
- Add config.example.json as a safe, secrets-free template for new deployments
- Add nginx.conf.example with proper reverse-proxy guards:
- Static files served by Nginx directly (not Flask)
- Explicit deny on .py, .json, .db, .log, .env and other sensitive extensions
- Block dot-files and __pycache__ paths
- No directory listing (autoindex off)
- HTTPS enforcement with HSTS
Antigravity