From d64d864175d9add1bd9518606cc04fe6d00cd707 Mon Sep 17 00:00:00 2001 From: openhands Date: Thu, 15 Oct 2026 16:03:17 +0200 Subject: [PATCH] docs(env): clarify captcha provider setup and key handling Document that CAPTCHA_PROVIDER accepts a provider name (e.g. turnstile) and spell out that the site key is public while the secret must stay on the host / in CI and never be committed. --- .env.example | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.env.example b/.env.example index 6269e0c1..bd7c8ae4 100644 --- a/.env.example +++ b/.env.example @@ -94,10 +94,14 @@ CLOUDFLARE_AUTO_BLOCK_ENABLED=true CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4 # --- CAPTCHA (env fallback; admin settings win when set) --- -# Enable Turnstile on register/login/forgot/resend without touching the DB. -# "none" (default), "turnstile", "recaptcha" or "hcaptcha". +# Enable a captcha on register/login/forgot/resend without touching the DB. +# "none" (default), "turnstile", "recaptcha" or "hcaptcha". Example: +# CAPTCHA_PROVIDER=turnstile CAPTCHA_PROVIDER= -# Cloudflare Turnstile keys from https://dash.cloudflare.com/turnstile +# Provider keys. The SITE key is public (it ships to every browser), the +# SECRET is server-only and must never be committed — set it on the host or as +# a masked CI/CD variable. Cloudflare Turnstile keys: +# https://dash.cloudflare.com/turnstile TURNSTILE_SITE_KEY= TURNSTILE_SECRET_KEY=