Constraints
Environment-driven secrets
API keys and OAuth clients come from dotenv / platform templates; values must not be committed or documented.
active
Source
.gitignore excludes .env and live Firebase/Google plist/json files while
allowing .local templates.
Consequences
Documentation may name variables (e.g. SUPERWALL_IOS_API_KEY) but never
values.