Please report security issues privately through GitHub's Security tab using "Report a vulnerability". Do not open a public issue for anything that could expose API keys, session tokens, or user photos.
Morphly reads all credentials from environment variables on the server. The
repository never contains a real key. If you fork this project, keep
CLOUDFLARE_API_TOKEN, ACCESS_PASSWORD, UPSTASH_REDIS_REST_TOKEN, and the
session signing secret out of git and out of browser code.
If a key is ever committed by accident, revoke it in the Cloudflare dashboard first, then remove it from history.