LearnFromCode is local-first: the workbook server has no API keys and does not call LLMs.

• .learn-from-code/ — learner profile, progress, generated course (gitignored)
• .env, credentials, service-account keys

• Do not paste secrets into course modules or analysis/manifest.json
• Prefer citing file paths over dumping config files that may contain tokens
• Review course.json before opting in to commit a shared team course (not the default)

serve.mjs binds to 127.0.0.1 by default and only reads/writes under .learn-from-code/.