diff --git a/.gitattributes b/.gitattributes
index b98d0d5..a206026 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,2 @@
 Configs/supportbot.yml filter=supportbot-token
+Configs/api.yml filter=api-secrets
diff --git a/.githooks/pre-commit b/.githooks/pre-commit
new file mode 100644
index 0000000..719f7eb
--- /dev/null
+++ b/.githooks/pre-commit
@@ -0,0 +1,3 @@
+#!/bin/sh
+cd "$(git rev-parse --show-toplevel)" || exit 1
+node scripts/verify-supportbot-token.js pre-commit
diff --git a/.githooks/pre-push b/.githooks/pre-push
new file mode 100644
index 0000000..509c81b
--- /dev/null
+++ b/.githooks/pre-push
@@ -0,0 +1,3 @@
+#!/bin/sh
+cd "$(git rev-parse --show-toplevel)" || exit 1
+node scripts/verify-supportbot-token.js pre-push
diff --git a/.gitignore b/.gitignore
index 2b73f8d..0cb7502 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,5 +3,8 @@ node_modules
 # Dashboard UI source (local only — publish public/dashboard/ instead)
 dashboard/
 
-.githooks
-scripts
+# Local git hooks + secret-stripping scripts (run npm run git:setup)
+scripts/
+
+# Local secrets — use *.example as templates
+Configs/api.yml
diff --git a/API/server.js b/API/server.js
index db5ae76..ee27a10 100644
--- a/API/server.js
+++ b/API/server.js
@@ -271,22 +271,59 @@ class APIServer {
         });
     }
 
+    resolveDashboardDir() {
+        const candidates = [
+            DASHBOARD_DIR,
+            path.join(process.cwd(), 'public', 'dashboard'),
+        ];
+        for (const dir of candidates) {
+            if (fs.existsSync(path.join(dir, 'index.html'))) {
+                return dir;
+            }
+        }
+        return null;
+    }
+
     setupDashboard() {
-        if (!fs.existsSync(DASHBOARD_DIR)) {
-            console.warn('[API] Dashboard UI missing. Ensure public/dashboard/ is present in your install.');
+        const dashboardDir = this.resolveDashboardDir();
+        const port = this.config.Port || 3000;
+
+        if (!dashboardDir) {
+            console.warn(
+                '[API] Dashboard UI missing — add the public/dashboard/ folder from the repository (index.html + assets/).',
+            );
+            this.app.get('/', (req, res) => {
+                res.status(503).type('html').send(`<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><title>SupportBot Dashboard</title>
+<style>body{font-family:system-ui,sans-serif;max-width:36rem;margin:3rem auto;padding:0 1rem;color:#e8e8f0;background:#0c0c10}
+h1{font-size:1.25rem}a{color:#a78bfa}</style></head><body>
+<h1>Dashboard files not found</h1>
+<p>The API is running, but <code>public/dashboard/</code> is missing from this install (no <code>index.html</code>).</p>
+<p>Clone or download the repo including <strong>public/dashboard/</strong>, then restart the bot.</p>
+<p><a href="/api/health">Check API health</a></p>
+</body></html>`);
+            });
             return;
         }
 
-        this.app.use(express.static(DASHBOARD_DIR));
+        console.log(`[API] Serving dashboard from ${dashboardDir}`);
 
-        this.app.get(/^(?!\/api).*/, (req, res, next) => {
-            if (req.method !== 'GET') return next();
-            res.sendFile(path.join(DASHBOARD_DIR, 'index.html'), (err) => {
+        this.app.use(
+            express.static(dashboardDir, {
+                index: 'index.html',
+                fallthrough: true,
+            }),
+        );
+
+        this.app.use((req, res, next) => {
+            if (req.method !== 'GET' && req.method !== 'HEAD') return next();
+            if (req.path.startsWith('/api')) return next();
+            res.sendFile(path.join(dashboardDir, 'index.html'), (err) => {
                 if (err) next(err);
             });
         });
 
-        console.log('[API] Dashboard available at http://localhost:' + (this.config.Port || 3000));
+        console.log('[API] Dashboard available at http://localhost:' + port);
     }
 
     start(port) {
@@ -981,7 +1018,7 @@ class APIServer {
                 });
 
                 // 4. Overwrite core folders (keep Configs + Data)
-                const coreFolders = ['API', 'Commands', 'Events', 'Structures', 'public', 'scripts'];
+                const coreFolders = ['API', 'Commands', 'Events', 'Structures', 'public'];
                 coreFolders.forEach(folder => {
                     const src = path.join(sourcePath, folder);
                     if (fs.existsSync(src)) {
diff --git a/Configs/api.yml.example b/Configs/api.yml.example
new file mode 100644
index 0000000..17a4097
--- /dev/null
+++ b/Configs/api.yml.example
@@ -0,0 +1,19 @@
+# -------------------------------
+#   API Server Configuration
+# -------------------------------
+# Copy to api.yml and fill in your values (api.yml is not committed with real secrets).
+
+API:
+  Enabled: true
+  Port: 3000
+
+  SecretKey: "CHANGE_ME"
+
+  OAuth:
+    Enabled: true
+    ClientId: "DISCORD_CLIENT_ID"
+    ClientSecret: "DISCORD_CLIENT_SECRET"
+    RedirectUri: "http://localhost:3000/api/auth/discord/callback"
+    OwnerUserIds:
+      - "YOUR_DISCORD_USER_ID"
+    AllowedUserIds: []
diff --git a/package.json b/package.json
index 1525f73..338ec6c 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
   "scripts": {
     "setup": "npm i && node index.js",
     "start": "node index.js",
-    "prepare": "node scripts/setup-git-security.js"
+    "git:setup": "node scripts/setup-git-security.js"
   },
   "repository": {
     "type": "git",