.env.example

# --- Fetch (advisory retrieval) ---
# http  = GET the URL directly (no key, no JS render, no 24h scan)
# tinyfish = JS render + 24h discovery (or any API that speaks the same Search/Fetch contract)
CVE2DETECT_FETCH_PROVIDER=http
FETCH_API_KEY=
# Optional overrides if your fetch API uses different hosts:
# FETCH_SEARCH_URL=https://api.search.tinyfish.ai
# FETCH_URL=https://api.fetch.tinyfish.ai
# FETCH_AGENT_URL=https://agent.tinyfish.ai/v1/automation/run

# --- LLM (telemetry extraction) ---
# gemini | openai | openai_compatible
# openai_compatible works with any OpenAI-style /v1/chat/completions endpoint
# (OpenAI, xAI, Groq, Together, vLLM, Ollama, Azure-compatible gateways, …)
CVE2DETECT_LLM_PROVIDER=openai_compatible
LLM_API_KEY=
LLM_MODEL=
# Comma-separated fallbacks used when the primary model returns 429/503.
# Example for Gemini: gemini-2.5-flash,gemini-2.0-flash
LLM_MODELS=
LLM_API_BASE=https://api.openai.com/v1

# Vendor aliases still work if you already have them:
# TINYFISH_API_KEY=
# GEMINI_API_KEY=
# GEMINI_MODEL=gemini-3.8-flash
# OPENAI_API_KEY=
# XAI_API_KEY=

CVE2DETECT_HOST=127.0.0.1
CVE2DETECT_PORT=8787
CVE2DETECT_DAILY_SEARCH=0
CVE2DETECT_SEARCH_RECENCY_MINUTES=1440
# Set to 1 only behind a reverse proxy that overwrites X-Forwarded-For.
CVE2DETECT_TRUST_PROXY=0