Skip to content

SECURITY_CHECKLIST.md

Latest commit

 

History

History
135 lines (108 loc) · 4.26 KB

SECURITY_CHECKLIST.md

File metadata and controls

135 lines (108 loc) · 4.26 KB

🔒 Security Checklist for GitHub Push

✅ Pre-Push Security Verification

1. Environment Variables

  • .env file exists with actual credentials (NOT committed to Git)
  • env.example file contains only placeholder values
  • No hardcoded secrets in any code files
  • All sensitive data moved to environment variables

2. Database Configuration

  • Supabase URL removed from config/supabase.js
  • Supabase Key removed from config/supabase.js
  • Database credentials removed from config/database.js
  • Connection strings use environment variables only

3. API Keys & Secrets

  • Google API credentials in environment variables only
  • JWT secrets in environment variables only
  • Session secrets in environment variables only
  • Payment API keys in environment variables only
  • Email/SMS credentials in environment variables only

4. Business Information

  • Real phone numbers replaced with placeholder values
  • Real email addresses replaced with placeholder values
  • Physical addresses replaced with placeholder values
  • Business names updated to generic "Signature Salon"

5. Git Configuration

  • .gitignore includes .env files
  • .gitignore includes node_modules/
  • .gitignore includes log files
  • No sensitive files accidentally committed

🛡️ Files to Verify

✅ Safe to Commit:

  • index.html - Frontend landing page
  • styles.css - Styling
  • script.js - Frontend JavaScript
  • server.js - Server code (no hardcoded secrets)
  • package.json - Dependencies
  • README.md - Documentation
  • env.example - Template with placeholders
  • .gitignore - Git ignore rules
  • config/supabase.js - ✅ Updated (no hardcoded secrets)
  • config/database.js - ✅ Updated (no hardcoded secrets)

❌ Never Commit:

  • .env - Contains actual secrets
  • node_modules/ - Dependencies
  • *.log - Log files
  • credentials.json - API credentials
  • Any files with hardcoded API keys

🔍 Final Verification Steps

1. Check for Hardcoded Secrets

# Search for potential secrets in code
grep -r "eyJ" . --exclude-dir=node_modules
grep -r "sk_" . --exclude-dir=node_modules
grep -r "pk_" . --exclude-dir=node_modules
grep -r "supabase.co" . --exclude-dir=node_modules

2. Verify Environment Variables

# Check if .env exists and is not tracked
git status .env
# Should show "untracked" or not appear at all

3. Test Application

# Ensure app works with environment variables
npm start
# Should start without hardcoded credential errors

📋 Environment Variables Template

Your .env file should contain:

# Supabase Configuration
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

# Database Configuration
DB_HOST=aws-0-ap-southeast-1.pooler.supabase.com
DB_USER=postgres.your-project
DB_PASSWORD=your-secure-password

# Security
SESSION_SECRET=your-random-session-secret
JWT_SECRET=your-random-jwt-secret

# Business Configuration
BUSINESS_NAME=Signature Salon
BUSINESS_PHONE=+971501234567
BUSINESS_EMAIL=info@signaturesalon.ae

🚨 Common Security Mistakes

  1. Hardcoded API Keys - Never put secrets directly in code
  2. Committed .env Files - Always use .gitignore
  3. Real Business Data - Use placeholder data in examples
  4. Database Passwords - Always use environment variables
  5. JWT Secrets - Generate random secrets for each environment

✅ Ready to Push Checklist

  • All hardcoded secrets removed
  • Environment variables properly configured
  • .env file exists locally (not committed)
  • env.example contains only placeholders
  • Application runs without credential errors
  • No sensitive data in Git history
  • README updated with setup instructions
  • Security checklist completed

🎯 After Pushing to GitHub

  1. Set up repository secrets for CI/CD
  2. Configure deployment environment variables
  3. Set up branch protection rules
  4. Enable security scanning (if available)
  5. Document deployment process

Remember: Security is an ongoing process. Regularly audit your code for any accidentally committed secrets and rotate credentials periodically.