diff --git a/public/join.html b/public/join.html
index 4f177b7..8d5a775 100644
--- a/public/join.html
+++ b/public/join.html
@@ -26,7 +26,7 @@
   .jn-chips span b{color:var(--mint);font-weight:700}
   .jn-spon{display:flex;align-items:center;gap:10px;margin:0 0 6px}
   .jn-spon img{width:34px;height:34px;border-radius:50%;object-fit:cover;border:1px solid var(--line-strong)}
-  .jn-full{margin-top:44px}
+  .jn-full{margin-top:26px}
   .jn-h{display:flex;justify-content:space-between;align-items:baseline;gap:16px;flex-wrap:wrap;margin:0 0 14px}
   .jn-h h2{font-size:26px;margin:0}
   .jn-h p{margin:0;font-size:14.5px}
diff --git a/server.js b/server.js
index c74f48e..a026bdc 100644
--- a/server.js
+++ b/server.js
@@ -516,9 +516,12 @@ const server = http.createServer(async (req, res) => {
     // -- public API
     if (p === '/api/config' && req.method === 'GET') {
       const c = chain.getConfig();
+      // public copy of the site settings: never anything that looks like a credential
+      const pubSite = {};
+      for (const [k, v] of Object.entries(siteConfig())) if (!/secret|token|password|private|apikey|api_key/i.test(k)) pubSite[k] = v;
       return json(res, 200, Object.assign({ contract: c.contract, chainId: c.chainId,
         chainName: c.chainName, explorer: c.explorer, rpc: c.rpcs[0],
-        emailAuth: mailer.hasKey() || !IS_PROD }, siteConfig()));
+        emailAuth: mailer.hasKey() || !IS_PROD }, pubSite));
     }
     if (p === '/api/moonpay-url' && req.method === 'GET') {
       // Card on-ramp deep link. With MoonPay keys set — PUBLIC key via