MOXIE DIGITAL — ULTROX AGEM V1 PROTECTION LAYER
================================================
This is a custom application protection layer name, not a hardware chipset.

WHAT IS PROTECTED
- Frontend JavaScript, CSS, website images and avatars are removed from public raw paths.
- 83 web assets are stored in private/assets as AES-256-GCM authenticated ciphertext (.mxv1).
- Assets are decrypted only by secure-asset.php after a valid first-party page session exists.
- Direct navigation/download requests do not receive the original asset; they are blocked or receive MXV1 ciphertext.
- index.html and private/data/security files are denied by Apache.
- Copied/local HTML contains a canonical clone guard that redirects to https://moxiedigital.in/.
- CSP, frame blocking, same-origin resource policy, no-store headers and canonical HTTPS/host enforcement are enabled.
- API/payment secrets remain server-side environment configuration; never place secret API keys in frontend JS/HTML.

SERVER KEY
- The deployable package contains private/.ultrox_key so the encrypted vault works immediately.
- private/ is denied from HTTP access. Keep it server-only with filesystem permissions 700/600 where possible.
- If the complete server filesystem/private key is stolen, the encrypted assets can be decrypted. Encryption cannot protect against theft of both ciphertext and its decryption key.

IMPORTANT LIMIT
Any asset that a browser can render is ultimately delivered in usable form to that browser. No website can make rendered HTML/JS/CSS/images mathematically impossible to inspect, screenshot or capture from browser memory/network tooling. This build is designed to stop casual source copying, direct raw-file access, hotlinking and simple cloning—not to make client-side code impossible to recover by a determined attacker.

DEPLOYMENT
- Upload the whole package, including .htaccess and private/.
- Apache mod_rewrite + mod_headers + PHP OpenSSL are recommended.
- Keep APP/API/Razorpay/Firebase/Gemini secrets in hosting environment variables as described in SECURITY_SETUP_README.txt.
- Rotate any API credential that was ever publicly exposed before using this package.
