Your project contains scripts that use external APIs (Google Gemini). Never commit your actual API keys.

cp .env.example .env

Edit .env and fill in your actual keys:

GEMINI_API_KEY=your_actual_gemini_api_key_here

1. Go to https://aistudio.google.com/app/apikey
2. Click "Create API Key"
3. Copy the key and paste into .env
4. Free tier: 60 requests/minute, unlimited requests/day

1. Go to https://platform.openai.com/api-keys
2. Create new API key
3. Add to .env as OPENAI_API_KEY

# Test that your script can load the API key
uv run python src/synthetic_generator.py

If successful, you'll see: Found X screenshots. Starting extraction...

✅ Do

• Use .env for all sensitive credentials
• Keep .env.example in repo (shows template only)
• Use load_dotenv() to load from .env
• Rotate API keys regularly
• Monitor API usage in your cloud console

❌ Don't

• Hardcode API keys in Python files
• Commit .env to Git (it's in .gitignore)
• Share your API keys in GitHub Issues/Discussions
• Use the same key across multiple projects
• Log API keys in error messages

ghost_architect_gemma3/
├── .env                 # ⚠️  YOUR ACTUAL KEYS (NEVER COMMIT)
├── .env.example         # ✅ Template (safe to commit)
├── .gitignore           # Already includes .env
└── src/
    └── synthetic_generator.py  # Loads from .env

Solution: Create .env file (copy from .env.example) and add your key.

Solution:

• Copy your key carefully (no extra spaces)
• Verify key hasn't expired in Google AI Studio
• Generate a new key and try again

Solution:

• Free tier: 60 requests/minute
• Wait 1 minute before retrying
• Upgrade to paid plan for higher limits

Solution (⚠️ Immediate action required):

1. Rotate all API keys immediately
2. Remove the file from Git history:

   git rm --cached .env
   git commit -m "Remove accidentally committed .env file"
   git push

3. Generate new API keys and update .env

❌ Bad (NEVER do this):

API_KEY = "sk-abc123..."  # Hardcoded!

✅ Good (do this):

from dotenv import load_dotenv
import os

load_dotenv()
API_KEY = os.environ.get("GEMINI_API_KEY")
if not API_KEY:
    raise ValueError("API_KEY not found in .env")

All scripts in this project follow the ✅ Good pattern.

GitHub automatically scans for exposed credentials:

• If you accidentally push an API key, GitHub will notify you
• Rotate the key immediately
• Remove from Git history using git filter-branch or bfg

See:

• .env.example — Template for all required keys
• src/synthetic_generator.py — Example of secure API loading
• requirements.txt — python-dotenv package details