diff --git a/AGENTS.md b/AGENTS.md
index 9acb9c6..0753f99 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,3 +48,16 @@ npm publish
      ```
 5. Verify: `curl -s https://registry.npmjs.org/@troed%2foc-ls-stats | jq '.dist-tags'`
 6. Restore the backup (`cp ~/.npmrc.bak-<timestamp> ~/.npmrc`) before the next local-registry publish.
+
+## Public repo hygiene
+
+- The Forgejo repo is public. Never commit internal hostnames, LAN IPs,
+  usernames, home paths, or credentials. Tracked files use placeholders
+  (`<server-host>`, `<user>`, `~/...`); server URLs use the `<server-host>` placeholder; the real value lives in environment variables or local config.
+
+- Automated checks: git hooks in `~/.githooks` (installed via global
+  `core.hooksPath`) block commits and pushes that match the hygiene pattern
+  (LAN IPs, `.local` hostnames, `/home/<user>` paths). Legitimate matches
+  (test fixtures, vendored code) belong in `.git/hygiene-excludes`.
+- Manual scan of the tracked tree (what the pre-push hook checks):
+  `source ~/.githooks/hygiene-lib.sh && hygiene_scan_tree HEAD`
diff --git a/README.md b/README.md
index 2b4bba0..21bdc47 100644
--- a/README.md
+++ b/README.md
@@ -56,7 +56,7 @@ If your llama-server provider is named differently, configure the endpoint expli
 ```json
 {
   "plugin": [
-    ["@troed/oc-ls-stats@latest", { "server": "http://headless.local:8080" }]
+    ["@troed/oc-ls-stats@latest", { "server": "http://<server-host>:8080" }]
   ]
 }
 ```
diff --git a/docs/superpowers/plans/2026-08-21-explicit-server-option.md b/docs/superpowers/plans/2026-08-21-explicit-server-option.md
index 2b4cee8..6a69710 100644
--- a/docs/superpowers/plans/2026-08-21-explicit-server-option.md
+++ b/docs/superpowers/plans/2026-08-21-explicit-server-option.md
@@ -37,15 +37,15 @@ const llamaConfig = {
 
 test("explicit server wins over provider detection", () => {
   assert.deepEqual(
-    resolveServerUrls({ server: "http://headless.local:8080" }, llamaConfig),
-    ["http://headless.local:8080"],
+    resolveServerUrls({ server: "http://<server-host>:8080" }, llamaConfig),
+    ["http://<server-host>:8080"],
   )
 })
 
 test("explicit server strips /v1 path", () => {
   assert.deepEqual(
-    resolveServerUrls({ server: "http://headless.local:8080/v1" }, {}),
-    ["http://headless.local:8080"],
+    resolveServerUrls({ server: "http://<server-host>:8080/v1" }, {}),
+    ["http://<server-host>:8080"],
   )
 })
 
@@ -70,7 +70,7 @@ test("no options uses detected providers", () => {
 test("no options and no matching providers falls back to localhost", () => {
   assert.deepEqual(
     resolveServerUrls(undefined, {
-      provider: { vision: { options: { baseURL: "http://headless.local:8080/v1" } } },
+      provider: { vision: { options: { baseURL: "http://<server-host>:8080/v1" } } },
     }),
     ["http://localhost:8080"],
   )
@@ -254,7 +254,7 @@ If your llama-server provider is named differently, configure the endpoint expli
 ```json
 {
   "plugin": [
-    ["@troed/oc-ls-stats@latest", { "server": "http://headless.local:8080" }]
+    ["@troed/oc-ls-stats@latest", { "server": "http://<server-host>:8080" }]
   ]
 }
 ```
diff --git a/docs/superpowers/plans/2026-08-21-provider-list-discovery.md b/docs/superpowers/plans/2026-08-21-provider-list-discovery.md
index bdd4059..8fd7b09 100644
--- a/docs/superpowers/plans/2026-08-21-provider-list-discovery.md
+++ b/docs/superpowers/plans/2026-08-21-provider-list-discovery.md
@@ -42,7 +42,7 @@ const visionProviders = [
     name: "vision",
     source: "config",
     env: [],
-    options: { baseURL: "http://headless.local:8080/v1" },
+    options: { baseURL: "http://<server-host>:8080/v1" },
     models: {},
   },
 ]
@@ -55,15 +55,15 @@ const llamaConfig = {
 
 test("explicit server wins over provider list", () => {
   assert.deepEqual(
-    resolveServerUrls({ server: "http://headless.local:8080" }, llamaProviders, {}),
-    ["http://headless.local:8080"],
+    resolveServerUrls({ server: "http://<server-host>:8080" }, llamaProviders, {}),
+    ["http://<server-host>:8080"],
   )
 })
 
 test("explicit server strips /v1 path", () => {
   assert.deepEqual(
-    resolveServerUrls({ server: "http://headless.local:8080/v1" }, llamaProviders, {}),
-    ["http://headless.local:8080"],
+    resolveServerUrls({ server: "http://<server-host>:8080/v1" }, llamaProviders, {}),
+    ["http://<server-host>:8080"],
   )
 })
 
@@ -106,7 +106,7 @@ test("no options uses provider list", () => {
 test("provider name match detects llama servers", () => {
   const byName = [{ ...visionProviders[0], name: "My llama server" }]
   assert.deepEqual(resolveServerUrls(undefined, byName, {}), [
-    "http://headless.local:8080",
+    "http://<server-host>:8080",
   ])
 })
 
diff --git a/docs/superpowers/specs/2026-08-21-explicit-server-option-design.md b/docs/superpowers/specs/2026-08-21-explicit-server-option-design.md
index 8b71c80..eea2a20 100644
--- a/docs/superpowers/specs/2026-08-21-explicit-server-option-design.md
+++ b/docs/superpowers/specs/2026-08-21-explicit-server-option-design.md
@@ -7,7 +7,7 @@ Status: Approved design, pending implementation plan
 
 The plugin discovers the llama-server URL by matching provider keys in the
 OpenCode config whose name contains "llama" (excluding "ollama"). On hosts
-where the provider is named differently (e.g. `"vision"` on headless.local),
+where the provider is named differently (e.g. `"vision"` on <server-host>),
 discovery fails and the plugin falls back to `http://localhost:8080`, which is
 wrong when llama-server runs on another host or port.
 
@@ -26,7 +26,7 @@ The option key is singular (`server`) because only one server is supported.
 ```json
 {
   "plugin": [
-    ["@troed/oc-ls-stats@latest", { "server": "http://headless.local:8080" }]
+    ["@troed/oc-ls-stats@latest", { "server": "http://<server-host>:8080" }]
   ]
 }
 ```
diff --git a/test-backoff.ts b/test-backoff.ts
index ed62034..dbbf58f 100644
--- a/test-backoff.ts
+++ b/test-backoff.ts
@@ -44,7 +44,7 @@ const visionProviders = [
     name: "vision",
     source: "config",
     env: [],
-    options: { baseURL: "http://headless.local:8080/v1" },
+    options: { baseURL: "http://<server-host>:8080/v1" },
     models: {},
   },
 ]
@@ -57,15 +57,15 @@ const llamaConfig = {
 
 test("explicit server wins over provider list", () => {
   assert.deepEqual(
-    resolveServerUrls({ server: "http://headless.local:8080" }, llamaProviders, {}),
-    ["http://headless.local:8080"],
+    resolveServerUrls({ server: "http://<server-host>:8080" }, llamaProviders, {}),
+    ["http://<server-host>:8080"],
   )
 })
 
 test("explicit server strips /v1 path", () => {
   assert.deepEqual(
-    resolveServerUrls({ server: "http://headless.local:8080/v1" }, llamaProviders, {}),
-    ["http://headless.local:8080"],
+    resolveServerUrls({ server: "http://<server-host>:8080/v1" }, llamaProviders, {}),
+    ["http://<server-host>:8080"],
   )
 })
 
@@ -108,7 +108,7 @@ test("no options uses provider list", () => {
 test("provider name match detects llama servers", () => {
   const byName = [{ ...visionProviders[0], name: "My llama server" }]
   assert.deepEqual(resolveServerUrls(undefined, byName, {}), [
-    "http://headless.local:8080",
+    "http://<server-host>:8080",
   ])
 })