If you cloned this repository before 2026-01-11, your .env.local may contain an exposed OpenAI API key.

1. Revoke the key:

   • Go to https://platform.openai.com/api-keys
   • Find key starting with sk-proj-fHChBCV...
   • Click "Revoke"

2. Generate new key:

   • Create new secret key
   • Copy to .env.local (NEVER commit)
   • Set spending limits

3. Verify .gitignore:

   # Ensure .env.local is ignored
   grep ".env.local" .gitignore

4. Remove from Git history (if committed):

   # WARNING: Rewrites history, coordinate with team
   git filter-branch --force --index-filter \
     "git rm --cached --ignore-unmatch .env.local" \
     --prune-empty --tag-name-filter cat -- --all
   
   git push --force --all
   git push --force --tags

DO NOT open a public GitHub issue for security vulnerabilities.

Instead:

1. Email: security@yourapp.com (replace with actual email)
2. Include:
   • Description of vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (optional)

We will respond within 48 hours.

• ✅ DO: Use .env.local for secrets (gitignored)
• ✅ DO: Prefix client-safe vars with NEXT_PUBLIC_
• ❌ DON'T: Commit .env.local to Git
• ❌ DON'T: Log secrets to console

• ✅ DO: Implement rate limiting (10 req/min)
• ✅ DO: Validate all inputs
• ✅ DO: Use server-side API keys only
• ❌ DON'T: Trust client input without validation

• ✅ DO: Deploy Firestore rules (npm run firebase:rules)
• ✅ DO: Use user-scoped paths: /users/{userId}/...
• ❌ DON'T: Allow public read/write access

• ✅ DO: Run npm audit regularly
• ✅ DO: Update dependencies quarterly
• ❌ DON'T: Ignore security warnings

For questions: security@yourapp.com