SECURITY HARDENED / IMPLEMENTATION PRIVACY

1. Set a strong persistent SECRET_KEY in the production environment.
2. Keep FORCE_HTTPS_COOKIES=1 when the site is served over HTTPS.
3. The unauthenticated / page returns a login-only document. The application bundle and application markup are not sent until authentication succeeds.
4. Application requests use opaque /x/a* paths and admin requests use opaque /x/b* paths. The admin panel is at /x7p4m.
5. Server-side authorization remains the source of truth. Obscure paths are not a security boundary.
6. Keep .env, source files, databases, JSON stores, logs, archives, __pycache__, and backups outside the public web root or explicitly denied by the web server.
7. Do not put provider credentials in frontend JavaScript. Provider calls remain server-side.
8. Browser DevTools can still show HTML/CSS/JS delivered after login and network requests; no web application can prevent that. This build minimizes meaningful implementation/provider information exposed to the browser.