🛡️ Sentinel: [CRITICAL] Fix exposed credentials.json

.gitignore

@@ -160,4 +160,6 @@ cython_debug/
 #  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
-#.idea/
+#.idea/
+# Security
+credentials.json

.jules/sentinel.md

@@ -21,3 +21,16 @@ Hardcoded credentials pose a critical risk because they provide an easy entry po
 **Prevention:**
 1. Never commit secrets, API keys, or passwords into the source code repository. Always read sensitive configuration using environment variables (e.g., `os.getenv`).
 2. Implement secure comparisons utilizing functions designed to prevent timing attacks, like `secrets.compare_digest()`, and properly encode inputs to prevent TypeErrors on non-ASCII characters.
+
+## 2024-05-20 - Exposed Google Service Account Credentials
+
+**Vulnerability:**
+The `credentials.json` file containing sensitive Google Service Account credentials (including private keys and client IDs) was committed to the repository and tracked by Git.
+
+**Learning:**
+Committing secrets and credentials files directly to the repository exposes sensitive systems to unauthorized access and potential data breaches, even in private repositories. It is a critical security risk.
+
+**Prevention:**
+1. Never commit secrets, API keys, or credentials files into the source code repository.
+2. Explicitly add known sensitive file names (like `credentials.json`, `.env`) to `.gitignore` to prevent accidental commits.
+3. Manage secrets securely outside of version control, using environment variables, secret managers, or securely injected files during deployment.