[Copilot]

A real JWT secret was committed verbatim in the .env reference block inside gervis-backend/docs/phase2-setup.md.

Change

• gervis-backend/docs/phase2-setup.md — replaced the hardcoded 64-char hex secret with an inline generation command:

-JWT_SECRET=3e865eb9024b6c0be7629880910af56805fef3e707c420afa2ca1a2dee44eb28
+JWT_SECRET=<generate-with: python3 -c "import secrets; print(secrets.token_hex(32))">

Recommended follow-up

• Rotate the exposed secret in Cloud Secret Manager — it was live in git history and may have been harvested by automated scanners
• Scrub git history with git-filter-repo or BFG Repo-Cleaner to remove the value from all prior commits

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Security: Exposed credentials detected in this repository</issue_title>
<issue_description>## Leaked Credentials Detected

Hi there! While reviewing public repositories submitted to the Gemini Live Agent Challenge, we ran an automated security scan and found exposed credentials in this repo.

This repository contains API keys committed in source code. Even if these keys are currently inactive, they may have been harvested by automated scanners. We recommend rotating them as a precaution.

What was found

File	Credential Type
gervis-backend/docs/phase2-setup.md	generic-api-key

Recommended actions

1. Revoke and rotate all exposed credentials immediately
   • For Google/GCP API keys: Google Cloud Console → APIs & Services → Credentials
   • For other services: check the respective provider's dashboard
2. Remove secrets from code — use environment variables or a secrets manager instead
3. Add .env to .gitignore to prevent future commits of secret files
4. Scrub git history — even after deleting the file, secrets remain in git history. Use git-filter-repo or BFG Repo-Cleaner to remove them
5. Consider using Google Secret Manager for production deployments

About this scan

This issue was created as part of a responsible disclosure effort after scanning public hackathon submissions. No credentials were used or exploited — only a read-only API endpoint was called to check if keys were active. The actual secret values are not included in this issue.

If you believe this is a false positive, feel free to close this issue.
</issue_description>

Comments on the Issue (you are @copilot in this section)

@peres84 @claude review this issue.

• Fixes Security: Exposed credentials detected in this repository #1

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.