Secret Audit

Scope: PlantAI-dev working copy created from bbav5_0502_Yang_Tihuan.7880.

Current Actions

Moved PlantCARE email account and IMAP authorization code out of apps/cli/run_promoter.py.
Kept private values in .env for local runtime compatibility.
Added .env.example with placeholders for future open-source setup.

.env contains private LLM API keys and must not be published.
memory/ and memory_storage/ include historical conversation/config records and should be removed or sanitized before publishing.
data/, 项目记录/, generated extension fixtures, benchmark outputs, and local reports should be separated from the public source release unless explicitly curated.
Search again for API_KEY, PASSWORD, TOKEN, SECRET, email addresses, and sk- before any public commit.