# Secret Audit

Scope: PlantAI-dev working copy created from bbav5_0502_Yang_Tihuan.7880.

## Current Actions

- Moved PlantCARE email account and IMAP authorization code out of `apps/cli/run_promoter.py`.
- Kept private values in `.env` for local runtime compatibility.
- Added `.env.example` with placeholders for future open-source setup.

## Still To Review Before Open Source

- `.env` contains private LLM API keys and must not be published.
- `memory/` and `memory_storage/` include historical conversation/config records and should be removed or sanitized before publishing.
- `data/`, `项目记录/`, generated extension fixtures, benchmark outputs, and local reports should be separated from the public source release unless explicitly curated.
- Search again for `API_KEY`, `PASSWORD`, `TOKEN`, `SECRET`, email addresses, and `sk-` before any public commit.