⚠ Demo login (admin/admin) is active — do not expose this to the internet.

⚠ Running in development mode: cookies are not marked Secure, so this must be served over localhost, not a public host.

⚠ AWS credentials come from LONG-LIVED KEYS (env), not an instance role. They do not expire, do not rotate, and survive being copied off this machine — and IMDSv2 hop-limit hardening does not protect them. Ask for an IAM instance profile.