Those two routes are only gated by requireAdminAuth (Basic Auth), independent
of LOG_EXPOSE_API, which controls /api/logs* and the dev/test echo endpoints.
Previous wording implied all of /api/logs*, /openapi.json, and /docs shared
the same LOG_EXPOSE_API gate.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
parseEnable()'s generic fallback (return true for an unset var) is correct
for the payment-method toggles it's shared with, but wrong for a security
gate: LOG_EXPOSE_API controlled whether /api/logs*, /openapi.json, and /docs
serve anything at all, and previously defaulted to true (open) when the env
var was absent, contradicting what .env.example already documented as the
safe default. Now explicitly defaults to 'false'.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Documents every environment variable read by server/index.cjs and the Vite
frontend (grep-verified against process.env.* / import.meta.env.* usage),
with placeholder values only — no real secrets. Not gitignored (.gitignore
already carves out an exception for it).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Tengku Achmad