Use the configured Secrets Gradle Plugin and environment files for sensitive values.

Never commit:

• API keys
• passwords
• signing credentials
• service-account files
• production keystores

Release signing uses environment variables. Debug signing is separate and must not be treated as a production identity.

Firebase Auth and Google Credential Manager dependencies are commented out. No active authentication flow was identified.

No active application-specific backend or persistent database implementation was identified in the inspected source tree.

Do not connect real sensitive supply-chain records to this prototype without implementing an appropriate authenticated backend, authorization, validation, secure storage and audit controls.

App Check dependencies are present for reCAPTCHA and debug, but production enforcement should not be claimed without active Firebase configuration and runtime verification.

Before production use, establish:

• authenticated access
• authorization
• secure backend architecture
• input validation
• sensitive-data protection
• secret rotation
• secure logging/redaction
• dependency scanning
• release signing controls
• data retention rules
• incident-response procedures