Harden app for release readiness

src/App.tsx

@@ -260,12 +260,17 @@ function readDefaults(): EnvDefault[] {
 
   try {
     const parsed = JSON.parse(stored) as EnvDefault[];
-    return Array.isArray(parsed) ? parsed : initialDefaults;
+    return Array.isArray(parsed) ? parsed.filter((entry) => entry.key && typeof entry.value === "string" && canPersistDefault(entry.key)) : initialDefaults;
   } catch {
     return initialDefaults;
   }
 }
 
+function canPersistDefault(key: string): boolean {
+  const signal = normalizeKey(key);
+  return !["PASSWORD", "SECRET", "TOKEN", "PRIVATE_KEY", "API_KEY", "ACCESS_KEY"].some((marker) => signal.includes(marker));
+}
+
 function readIgnoredAutoDefaults(): string[] {
   const stored = localStorage.getItem("envhelper-ignored-auto-defaults");
   if (!stored) {
@@ -518,7 +523,7 @@ export default function App() {
   }, [language]);
 
   useEffect(() => {
-    localStorage.setItem("envhelper-defaults", JSON.stringify(manualDefaults));
+    localStorage.setItem("envhelper-defaults", JSON.stringify(manualDefaults.filter((entry) => canPersistDefault(entry.key))));
   }, [manualDefaults]);
 
   useEffect(() => {