CRITICAL: Hardcoded private key in scripts/ and backend/.env committed to repo

[Mosss-OS]

Description

A deployer wallet private key is hardcoded in two locations and should be treated as compromised.

Locations

1. scripts/deploy-marketplace.js line 18 — plaintext private key 0xcb601f...
2. backend/.env — the same key is stored and this file is NOT in .gitignore (only root .env is ignored, not backend/.env)

Impact

Anyone with access to this repo can drain the deployer wallet on testnets and deploy contracts impersonating the owner.

Fix

• Rotate the key immediately (fund a new wallet, transfer any remaining testnet funds)
• Remove the hardcoded key from scripts/deploy-marketplace.js — use env vars via process.env.DEPLOYER_PRIVATE_KEY
• Add backend/.env to .gitignore
• Verify git no longer tracks the file with git rm --cached backend/.env