In `@README.md`:
- Around line 15-48: Change the README wording that currently says "Pass only
the API keys you need" to a more accurate phrase such as "Pass only the provider
credentials or base URL you need" and update the surrounding examples and table
header so non-key credentials (e.g., OLLAMA_BASE_URL) are covered; specifically
edit the introductory sentence and the table column title "Environment Variable"
to something like "Credential / Env Variable" and ensure entries like
OPENAI_API_KEY, OLLAMA_BASE_URL, ANTHROPIC_API_KEY, GEMINI_API_KEY,
GROQ_API_KEY, XAI_API_KEY are all represented consistently.
- Around line 111-123: Add a short "Quick Start — Authentication" warning to the
README next to the environment variables table that calls out
GOMODEL_MASTER_KEY: state that by default there is no master key
(GOMODEL_MASTER_KEY is unset), this is insecure for production, and strongly
recommend setting a strong secret before exposing the service; include a brief
example of intended behavior (e.g., "without this key, API endpoints are
unprotected") and a one-line instruction to set GOMODEL_MASTER_KEY in the .env
or environment for production deployments.
- Around line 9-24: Update the Docker usage examples to avoid encouraging
passing secrets on the command line: add a brief explicit warning that
environment variables on the CLI can leak via shell history and process lists,
and recommend using docker --env-file or a .env file (or docker run --env-file)
to load API keys instead; update the examples around the docker run snippets and
mention that at least one API key is required while pointing readers to the
safer --env-file approach.

In `@README.md`:
- Around line 88-93: Update the "Building the Docker Image Locally" Quick Start
section to use the safer .env file approach (as shown in the "Alternative Setup
Methods" section) instead of demonstrating passing secrets via docker run -e;
change the Quick Start steps under the "Building the Docker Image Locally"
heading to instruct creating a .env with GEMINI_API_KEY and running docker run
--env-file, and move the direct -e flag example (plus a clear security warning
about exposing secrets) into the "Alternative Setup Methods" section where the
.env pattern currently appears.

In `@DEVELOPMENT.md`:
- Around line 5-9: Update the DEVELOPMENT.md entry for the make test-e2e target
to note that it builds with the -tags=e2e build tag and runs using in-process
mock servers (no Docker); specifically edit the make test-e2e line so its
comment reads something like "End-to-end tests (requires -tags=e2e; uses
in-process mock servers, no Docker)" to match the Makefile behavior and project
testing guidelines.

In `@README.md`:
- Around line 45-101: Replace the retired Anthropic model identifier
"claude-3-5-sonnet-20241022" with "claude-sonnet-4-20250514" in the table row
for Anthropic, and add a short disclaimer line above the table such as "Example
model identifiers are illustrative and subject to change; consult provider
catalogs for current models." to indicate model freshness (refer to the
Anthropic model string and the table block containing provider rows).