.env.example

PORT=5000
API=http://localhost:5000/predict


FLASK_PORT=5000
# Flask ML API debugger. Keep OFF (false) outside local development — the
# Werkzeug debugger allows remote code execution. Accepts 1/true/yes/on.
FLASK_DEBUG=false
# Interface the Flask ML API binds to. Defaults to localhost only. Set to
# 0.0.0.0 to expose on all interfaces (only behind a trusted proxy, and never
# together with FLASK_DEBUG=true — the app will refuse to start).
FLASK_HOST=127.0.0.1
MODEL_PATH=linear_svm_model.pkl
VECTORIZER_PATH=tfidf_vectorizer.pkl
LABEL_ENCODER_PATH=label_encoder.pkl
URL_MODEL_PATH=url_detector.pkl
URL_VECTORIZER_PATH=url_vectorizer.pkl

EXPO_PUBLIC_ANDROIDAPI=http://10.0.2.2:3000/predict
EXPO_PUBLIC_IOSAPI=http://localhost:3000/predict

DB_HOST=localhost
DB_USER=root
DB_PASSWORD=
DB_NAME=spam_detection

# Shared secret the Node/Express backend sends to the Flask ML API on every
# request. The ML API rejects (403) any request without it, so the model
# endpoints can't be called directly. This is MANDATORY — both services refuse
# to start if it is missing or shorter than 32 characters. There is no default;
# set the SAME value for the Node and Flask services.
# Generate a strong value with either:
#   node   -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
#   python -c "import secrets; print(secrets.token_urlsafe(32))"
INTERNAL_SECRET=

# Comma-separated list of origins allowed by the Express CORS policy in
# production (e.g. https://app.example.com,https://www.example.com).
ALLOWED_ORIGINS=

# Authentication
MONGODB_URI=mongodb+srv://<user>:<password>@cluster0.xxxxx.mongodb.net/spamdetection?retryWrites=true&w=majority
JWT_SECRET=your_super_secret_jwt_key_change_this_in_production
JWT_EXPIRES_IN=7d

# Google OAuth
GOOGLE_CLIENT_ID=your_google_client_id_here
VITE_GOOGLE_CLIENT_ID=your_google_client_id_here


# Rate Limiting
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX=100
# CSV Upload Security
MAX_CSV_FILE_SIZE=10485760  # 10MB
MAX_CSV_ROWS=100000         # 100k rows max
ENABLE_MALWARE_SCAN=false   # Enable ClamAV scanning
CLAMAV_HOST=localhost
CLAMAV_PORT=3310

# Archival Job Schedule (Cron expression)
# Default is '0 3 * * *' (run once daily at 3:00 AM)
ARCHIVAL_CRON_SCHEDULE=0 3 * * *