teruselearning · teruselearning · Jun 10, 2026 · Jun 10, 2026
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenStudbook Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
@@ -1,15 +1,10 @@
-<div align="center">
-<img width="1200" height="475" alt="OpenStudbook Banner" src="https://github.com/user-attachments/assets/0aa67016-6eaf-458a-adb2-6e31a0763ed6" />
-
 # OpenStudbook
 
 **Open-source captive breeding and botanical collection management for zoos, aquariums, and botanical gardens.**
 
 [![Security Audit](https://github.com/teruselearning/openstud/actions/workflows/security.yml/badge.svg)](https://github.com/teruselearning/openstud/actions/workflows/security.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-emerald.svg)](LICENSE)
 
-</div>
-
 ---
 
 OpenStudbook is a self-hosted web platform for managing captive animal and plant populations. Track individuals, species, breeding events, genetic lineage, health records, and enclosures — with a global network map for inter-organisation partnerships.
@@ -18,9 +13,8 @@ OpenStudbook is a self-hosted web platform for managing captive animal and plant
 - 🐾 **Fauna & Flora modes** — unified management for animals and plants
 - 🧬 **Studbook & genetics** — lineage tracking, breeding recommendations, DNA records
 - 🌍 **Network map** — discover partner organisations and propose breeding loans
-- 🤖 **AI assist** — species autofill and illustration via Gemini (optional)
 - 🔒 **Multi-factor auth**, per-org user roles, and full data export
-- 🌐 **Multi-language** — 10+ languages with live AI translation
+- 🌐 **Multi-language** — 10 languages, switchable per user
 
 ---
 
@@ -33,10 +27,10 @@ OpenStudbook is a self-hosted web platform for managing captive animal and plant
 - [First-Time Setup (Installer)](#first-time-setup-installer)
 - [Production Deployment](#production-deployment)
 - [Resetting the Database](#resetting-the-database)
-- [Optional: AI Features](#optional-ai-features)
 - [Optional: Cloudflare / ngrok Tunnel](#optional-cloudflare--ngrok-tunnel)
 - [Security](#security)
 - [Contributing](#contributing)
+- [License](#license)
 
 ---
 
@@ -103,7 +97,6 @@ cp backend/.env.example backend/.env
 | `DATABASE_USER` | **Yes** | DB username |
 | `DATABASE_PASSWORD` | **Yes** | DB password |
 | `DATABASE_NAME` | **Yes** | DB name (e.g. `openstudbook`) |
-| `API_KEY` | No | Gemini API key — enables AI species autofill and illustrations. [Get one free.](https://aistudio.google.com/) |
 
 > **Never commit `backend/.env`** — it is gitignored by default.
 
@@ -299,24 +292,6 @@ Then restart the backend — it will re-run migrations and show the installer on
 
 ---
 
-## Optional: AI Features
-
-OpenStudbook integrates with [Google Gemini](https://aistudio.google.com/) for:
-
-- **Species autofill** — fill conservation status, lifespan, weight from scientific name
-- **AI illustration** — generate a representative species image
-- **Language translation** — auto-translate UI strings into new languages
-
-To enable, add your key to `backend/.env`:
-
-```
-API_KEY=your_gemini_api_key_here
-```
-
-AI usage is tracked per organisation and capped by the Super Admin. Organisations can also provide their own Gemini API key in Org Settings to bypass the shared limit.
-
----
-
 ## Optional: Cloudflare / ngrok Tunnel
 
 Expose your local dev instance publicly (useful for mobile testing, demos, or webhook testing).
@@ -337,7 +312,12 @@ Both print a public HTTPS URL to the console.
 
 ## Security
 
-See the [security maintenance plan in CLAUDE.md](CLAUDE.md#security-maintenance-plan) for the full automated and manual security schedule.
+The production checklist above covers the essential hardening steps. For ongoing maintenance:
+
+- Rotate `JWT_SECRET` and `DATABASE_PASSWORD` quarterly
+- Run `npm audit` in both root and `backend/` regularly — fix anything at high or critical severity
+- Review and merge Dependabot PRs promptly
+- Audit Super Admin accounts periodically — remove any that are no longer needed
 
 To report a vulnerability, please open a [GitHub Security Advisory](https://github.com/teruselearning/openstud/security/advisories/new) rather than a public issue.
 
@@ -356,6 +336,12 @@ For larger changes, open an issue first to discuss the approach.
 
 ---
 
+## License
+
+MIT © OpenStudbook Contributors — see [LICENSE](LICENSE).
+
+---
+
 <div align="center">
   <sub>Built with ❤️ for wildlife conservation and botanical management.</sub>
 </div>
diff --git a/backend/package.json b/backend/package.json
@@ -10,7 +10,7 @@
   },
   "keywords": [],
   "author": "",
-  "license": "ISC",
+  "license": "MIT",
   "dependencies": {
     "@google/genai": "^1.33.0",
     "bcryptjs": "^2.4.3",

diff --git a/backend/src/index.ts b/backend/src/index.ts
@@ -49,7 +49,13 @@ const resetPool = (newConfig: any) => {
 
 const app: any = express();
 const PORT = Number(process.env.PORT) || 3001;
-const JWT_SECRET = process.env.JWT_SECRET || 'openstudbook-stable-dev-secret-2024';
+if (!process.env.JWT_SECRET) {
+  console.error('\n⛔  FATAL: JWT_SECRET is not set in backend/.env');
+  console.error('   Generate one: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"');
+  console.error('   See backend/.env.example for full configuration.\n');
+  process.exit(1);
+}
+const JWT_SECRET = process.env.JWT_SECRET as string;
 
 app.use(cors({ origin: '*' }));
 app.use(express.json({ limit: '50mb' }));