.env.example as a local template; never commit a real .env.
Public variables are embedded in browser assets. Do not put private RPC credentials, passwords, signing keys, or other secrets in
NEXT_PUBLIC_*.
Missing or malformed financial configuration fails closed. Addresses alone do not enable writes. Production Next.js builds additionally require exactly https://cooket.fun and https://api.cooket.fun for the public application and API origins.
The production Compose file configures API and realtime listeners on loopback for an external reverse proxy. It does not prove DNS, TLS, proxy configuration, or service health.