[ChinaYiqun]

What changed

• removes hard-coded provider, Redis, Elasticsearch, Jina, and SerpAPI credentials from Config.java;
• preserves the existing Config.* field API while resolving values from JVM system properties, then environment variables, then safe non-secret defaults;
• adds .env.example and ignores local environment/configuration files;
• adds a security response guide that explicitly requires rotation of every previously committed credential;
• adds a current-tree credential guard;
• adds Maven CI on Java 8;
• adds unit coverage for external configuration and required-secret validation;
• updates the README with secure startup instructions.

Why

The public repository contained credential-like values and remote infrastructure passwords. Deleting them from the latest source does not revoke them or remove them from Git history, so they must be considered compromised. This PR prevents continued use of committed secrets and adds guardrails against reintroducing them.

Compatibility

Existing references such as Config.API_KEY, Config.REDIS_HOST, Config.esUrl, and Config.Jina_API_KEY remain available. Deployments can configure the project with environment variables or -D JVM properties without adopting a framework.

Required owner action

After merge, rotate all affected provider and infrastructure credentials. Git history rewriting is optional cleanup and is not a replacement for rotation.

Validation

GitHub Actions runs:

bash scripts/check-no-hardcoded-secrets.sh
mvn --batch-mode --no-transfer-progress test