This repository must never contain:

• API keys (OpenAI, Geocodio, Twilio, AWS, etc.)
• Passwords or database connection strings with real credentials
• Private keys (.pem, .key, SSH keys)
• Tokens (JWT secrets, OAuth tokens, etc.)
• Environment files with real values (.env, .env.local, .env.production)

• Use backend/env.example as a template—copy to .env locally and never commit .env
• All real credentials go in:
  • Local: .env (gitignored)
  • CI/CD: GitHub Actions Secrets, Render/Vercel environment variables
  • Production: Platform secret managers (AWS Secrets Manager, etc.)

• backend/env.example – placeholder values only (your-openai-api-key, etc.)
• *.tfvars.example – Terraform variable templates
• .env.example, .env.template – frontend/env templates

• .env, .env.local, .env.production
• secrets/ (created by deploy scripts)
• *.tfvars (Terraform values, often contain secrets)
• *.pem, *.key, credentials.json, config.json with secrets

1. Rotate the secret immediately – assume it is compromised
2. Remove from history – use git filter-branch or BFG Repo-Cleaner
3. Force-push (coordinate with team)
4. Re-rotate any secrets that may have been exposed

Report security issues to: kaitlin.cort@owasp.org

• Gitleaks runs on every push and PR to detect hardcoded secrets
• .gitignore is configured to exclude sensitive files from version control