Security / 安全说明 English Never commit .env, config/secrets.bin, local media, generated videos, or runtime folders. API keys are loaded from .env or stored locally by the WebUI in encrypted form. Before opening a pull request, run a secret scan and make sure no personal paths or credentials are included. 中文 不要提交 .env、config/secrets.bin、本地素材、生成成片或运行缓存目录。 API Key 从 .env 读取，或由 WebUI 加密保存在本机。 提交 PR 前请先检查是否包含明文密钥、个人路径或私人素材。