Environment status and scoring configuration. API keys stay in .env.local and are never exposed to the browser.