Last security check

includes/ai.php

@@ -131,12 +131,13 @@ function fociz_ai_chat_gemini(array $messages, array $options, array $aiSettings
         $payload['generationConfig']['responseMimeType'] = 'application/json';
     }
 
-    $endpoint = "https://generativelanguage.googleapis.com/v1beta/models/{$model}:generateContent?key=" . urlencode($apiKey);
+    $endpoint = "https://generativelanguage.googleapis.com/v1beta/models/{$model}:generateContent";
 
     $response = fociz_http_request($endpoint, [
         'method'  => 'POST',
         'headers' => [
-            'Content-Type' => 'application/json',
+            'Content-Type'   => 'application/json',
+            'x-goog-api-key' => $apiKey,
         ],
         'body'    => $payload,
         'timeout' => 45,

includes/env_badge.php

@@ -56,7 +56,7 @@ $isLive = in_array(strtolower(trim($environment)), ['live', 'production', 'prod'
                 <span>Development</span>
             </span>
 
-            <span class="hidden sm:inline-block text-[9px] font-mono font-bold px-1.5 py-0.2 rounded bg-red-500/20 text-red-300 border border-red-500/30">
+            <span class="hidden sm:inline-block text-[9px] font-mono font-bold px-1.5 py-0.5 rounded bg-red-500/20 text-red-300 border border-red-500/30">
                 DEV
             </span>
         </div>