GHOST API KEY SECURITY
======================

The public package intentionally contains no API secret.

Why:
A key embedded in HTML, JavaScript, JSON, BAT, PowerShell or a ZIP can be extracted and abused by anyone who receives the package.

Safe setup:
1. Install GHOST.
2. Open System Settings > AI Providers.
3. Select “Bynara — Agnes 2.0 Flash”.
4. Paste a private API key.
5. Save Provider.
6. Click Use This API.

On Windows, GHOST attempts to protect the key with DPAPI for the current Windows account.
Rotate any key that has already been shared in a chat, screenshot, repository or post.
