- Remove the committed firebase-debug.log (contains a personal Google
account) and gitignore it. NOTE: still present in history — a history
rewrite or written confirmation is still outstanding
- Remove the client-side skipPaymentCheck approval bypass
- Replace the wildcard image remote host "**" with an explicit allowlist
(adds DigitalOcean Spaces)
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>