added IP whitelisting

.env.example

@@ -5,6 +5,21 @@ ENVIRONMENT=development  # IMPORTANT: Change to 'production' for production depl
 # Security - REQUIRED
 API_KEY=CHANGE-THIS-USE-32-CHARS-MINIMUM!!
 
+# IP Whitelist (Optional but RECOMMENDED for production)
+# Comma-separated list of allowed IPs or CIDR ranges
+# Leave empty to allow all IPs (NOT recommended for production)
+# Examples:
+#   Single IP: ALLOWED_IPS=203.0.113.50
+#   Multiple IPs: ALLOWED_IPS=203.0.113.50,198.51.100.25
+#   CIDR range: ALLOWED_IPS=192.168.1.0/24
+#   Mix: ALLOWED_IPS=203.0.113.50,192.168.1.0/24,10.0.0.0/8
+ALLOWED_IPS=
+
+# Enable GitHub Actions IP ranges (automatically whitelists GitHub's IPs)
+# Set to 'true' to allow GitHub Actions to access your API
+# Updates every 24 hours automatically
+ENABLE_GITHUB_IP_RANGES=false
+
 # CORS Configuration
 # IMPORTANT: Update this for production deployments
 CORS_ALLOWED_ORIGINS=http://localhost:3000