security: .env real values sent to deployment API — send .env.example keys only by default

[samsonajulor]

Summary

readEnvVars() in internal/deploy/deploy.go reads .env first (real secrets), then .env.example. Production secrets (API keys, DB passwords, JWT secrets) are automatically sent to the QuikDB deployment API on every quikdb-frame deploy.

Vulnerable code

deploy.go:347-366

func readEnvVars() map[string]string {
    for _, f := range []string{".env", ".env.example"} {  // .env first — wrong!
        ...
        vars[parts[0]] = parts[1]  // sends actual secret values
    }
}

Fix

Reverse read order — try .env.example first. When .env is used, warn the user:

for _, f := range []string{".env.example", ".env"} {

Add warning output:

Warning: Reading env vars from .env (real values will be sent to QuikDB).
Tip: Set secrets in the dashboard at https://compute.quikdb.com/deployments/{id}/settings

Severity

HIGH — users with real secrets in .env leak them silently.