.env.example

# Snout server + web environment. Copy to .env and fill in locally.
# NEVER commit a real .env. The .env file is gitignored; this placeholder
# template with safe defaults is the only env file that belongs in the repo.
# Secret values are intentionally left blank. Fill them in your local .env only.

# ---- Runtime ----
NODE_ENV=development
PORT=8787
DATA_DIR=./data
TRUST_PROXY=loopback

# ---- Origins / URLs ----
WEB_ORIGIN=http://localhost:5173
APP_BASE_URL=http://localhost:5173
# Web dev-server proxy target (web/vite.config.js)
SERVER_URL=http://localhost:8787
VITE_DEMO=false

# ---- LLM provider ----
LLM_PROVIDER=anthropic
ANTHROPIC_API_KEY=
ANTHROPIC_MODEL=claude-sonnet-4-6
ANTHROPIC_BASE_URL=https://api.anthropic.com
# Generic / OpenAI-compatible fallback provider
LLM_BASE_URL=
LLM_API_KEY=
LLM_MODEL=

# ---- API auth ----
API_TOKEN=
API_VIEWER_TOKEN=
ALLOW_ANON=false
SESSION_SECRET=
TENANT_ID=default

# ---- OIDC (optional SSO) ----
OIDC_ISSUER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=
OIDC_SCOPES=openid email profile
OIDC_ROLE_CLAIM=groups
OIDC_ADMIN_VALUE=
OIDC_TENANT_CLAIM=

# ---- Integrations (server-side secrets only; never expose in a client bundle) ----
SNOUT_WEBHOOK_SECRET=
SLACK_SIGNING_SECRET=
TEAMS_SECURITY_TOKEN=
OKTA_API_TOKEN=

# ---- Storage ----
DATABASE_URL=

# ---- Limits / behavior ----
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX=300
ASSESS_RATE_MAX=15
MAX_CONCURRENT_ASSESSMENTS=4
BODY_LIMIT=64kb
VERIFY_FINDINGS=false
SEED_DELAY_MS=3000