Skip to content

SECURITY_CHECKLIST.md

Latest commit

 

History

History
108 lines (74 loc) · 3.03 KB

SECURITY_CHECKLIST.md

File metadata and controls

108 lines (74 loc) · 3.03 KB
Raw

🔐 Security Checklist - API Key Exposure Fix

⚠️ CRITICAL: API Keys Were Exposed

Exposed Keys Found:

  • SendGrid API Key: [REDACTED - Key has been removed from codebase]

🚨 IMMEDIATE ACTIONS REQUIRED

1. Regenerate Compromised API Keys (URGENT)

  • SendGrid: Go to SendGrid Dashboard → Settings → API Keys → Delete the exposed key
  • Create new SendGrid API key with appropriate permissions
  • Gemini API: Check Google Cloud Console for any exposed keys and regenerate if needed
  • Firebase: Check Firebase Console for any exposed keys and regenerate if needed

2. Update Environment Variables

  • Edit .env.local file with your new API keys
  • Test that all services work with new keys
  • Never commit .env.local to git

3. Clean Git History

  • Run: ./cleanup-git-history.sh
  • Force push cleaned history: git push --force-with-lease origin main
  • Notify any collaborators to re-clone the repository

4. Repository Security

  • Consider making repository private temporarily
  • Check if any forks exist and contact owners
  • Review all commits for other potential exposures

🛡️ PREVENTION MEASURES

Environment Variables Setup

# Run the template script (creates .env.local with placeholders)
./setup-env-template.sh

# Edit the created .env.local file with your actual keys
nano .env.local

Git History Cleanup

# Make scripts executable
chmod +x cleanup-git-history.sh

# Run cleanup (WARNING: Rewrites history)
./cleanup-git-history.sh

# Force push cleaned history
git push --force-with-lease origin main

Security Best Practices

  • Never commit API keys to git
  • Use .env.local for local development
  • Use environment variables in production
  • Regularly audit git history for secrets
  • Use tools like git-secrets or truffleHog to scan for secrets

🔍 VERIFICATION STEPS

Check for Remaining Exposures

# Search for potential API keys in current files
grep -r "AIza[A-Za-z0-9_-]{35}" . --exclude-dir=node_modules
grep -r "SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}" . --exclude-dir=node_modules
grep -r "sk-[A-Za-z0-9]{48}" . --exclude-dir=node_modules

Test Environment Variables

# Check if environment variables are loaded
npm run dev
# Visit /config page to verify all services are configured

📞 SUPPORT CONTACTS

If you need help with any of these steps:

✅ COMPLETION CHECKLIST

  • All compromised API keys regenerated
  • New keys added to .env.local
  • Git history cleaned with BFG
  • Repository force-pushed with clean history
  • All services tested with new keys
  • Repository security reviewed
  • Team notified of changes

Remember: API key exposure is a serious security issue. Take immediate action to regenerate keys and clean your git history.