Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .env
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_YWNjZXB0ZWQtY2hvdy05NS5jbGVyay5hY2NvdW50cy5kZXYk
CLERK_SECRET_KEY=sk_test_mpfZe0XiSoV5SZgUn8ZqCNT9pVTu4fYMTAdcpIH8X7

NEXT_PUBLIC_CLERK_SIGN_IN_URL=/sign-in
NEXT_PUBLIC_CLERK_SIGN_UP_URL=/sign-up

NEXT_PUBLIC_STREAM_API_KEY=wmvqzwwh9s4q
STREAM_SECRET_KEY=86e88tqe2h82zvah5ge99ct584fn2gwd8mhewyy87vkesk4zmm6z62bgqegwer7j

NEXT_PUBLIC_BASE_URL=https://ro0m.vercel.app
Comment on lines +1 to +10
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Critical: Secrets are committed to the repo (.env). Remove and rotate immediately.
Committing CLERK_SECRET_KEY and STREAM_SECRET_KEY (even test keys) is a high-severity leak. These credentials should be considered compromised.

Immediate actions:

  • Revoke/rotate the exposed secrets in Clerk and Stream dashboards.
  • Remove the file from Git and from history:
    • In this PR: run git rm --cached .env, commit, and push (the file will remain in history).
    • To purge history (recommended for public repos): use BFG Repo-Cleaner or git filter-repo to remove .env from all commits, then force-push.
  • Add a non-sensitive .env.example with placeholders and keep .env ignored (rules are already in .gitignore).

Optionally, I can provide a .env.example template with the correct keys and comments.

🧰 Tools
🪛 dotenv-linter (3.3.0)

[warning] 2-2: [UnorderedKey] The CLERK_SECRET_KEY key should go before the NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY key

(UnorderedKey)


[warning] 10-10: [EndingBlankLine] No blank line at the end of the file

(EndingBlankLine)

🤖 Prompt for AI Agents
.env lines 1-10: Sensitive secrets (CLERK_SECRET_KEY, STREAM_SECRET_KEY, etc.)
are committed and must be removed and rotated immediately; revoke/rotate the
exposed keys in Clerk and Stream dashboards, delete the file from the repo with
git rm --cached .env then commit and push, and purge the secret from history
using BFG or git filter-repo (force-push after cleaning) for public repos; add a
non-sensitive .env.example with placeholder values, ensure .env is listed in
.gitignore, and avoid re-committing real secrets.

10 changes: 7 additions & 3 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,13 @@
# testing
/coverage

# environment variables
.env
.env.local
.env.development.local
.env.test.local
.env.production.local

# next.js
/.next/
/out/
Expand All @@ -35,6 +42,3 @@ yarn-error.log*
*.tsbuildinfo
next-env.d.ts

.vscode

.env
1 change: 1 addition & 0 deletions .nvmrc
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
18
Loading