Do not commit secrets to this repository.

Runtime credentials must be provided through environment variables, .env files that are excluded from Git, or your deployment secret manager. The repository ships only .env.example placeholders.

Known external services that may require credentials:

• STEAM_HOST, STEAM_APP_ID, STEAM_APP_KEY for optional judge/search gateways.
• LONGCAT_API_URL, LONGCAT_API_KEY for optional GRPO reward judging.
• WIKI_DICT_SERVICE_URL, WIKI_DICT_SERVICE_TOKEN for optional remote wiki data generation.
• JINA_API_KEY, TOP_APP_KEY, TOP_APP_SECRET, AIDATA_REQUEST_TOKEN for optional private real-page readers.

If a credential has ever been committed to Git history, treat it as leaked and rotate it before publishing the repository.

Before publishing a public repository, run the source-tree checks:

bash scripts/open_source_check.sh

If credentials or private endpoints ever appeared in Git history, do not publish that history. Either rewrite history with a dedicated tool and rotate affected credentials, or export a clean source tree without .git metadata:

bash scripts/export_open_source_tree.sh /path/to/virtualtools-open-source