docs: add secret generation guidance to .env.example and README (#207) (#254)

Author: Sweksha-Kakkar

.env.example

@@ -1,13 +1,17 @@
 # ─── Database ───
-DATABASE_URL=postgresql://devcard:devcard@localhost:5433/devcard?schema=public
+DATABASE_URL=postgresql://devcard:devcard@localhost:5432/devcard?schema=public
 
 # ─── Redis ───
 REDIS_URL=redis://localhost:6379
 
 # ─── JWT ───
+# JWT_SECRET: any long random string, minimum 32 characters
+# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 JWT_SECRET=your-super-secret-jwt-key-change-in-production
 
 # ─── Encryption (for OAuth tokens) ───
+# ENCRYPTION_KEY: must be exactly 32 bytes = 64 hex characters
+# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 ENCRYPTION_KEY=your-32-byte-hex-encryption-key-here
 
 # ─── GitHub OAuth ───
@@ -19,10 +23,10 @@ GOOGLE_CLIENT_ID=your-google-client-id
 GOOGLE_CLIENT_SECRET=your-google-client-secret
 
 # ─── App URLs ───
-PUBLIC_APP_URL=http://YOUR_COMPUTER_LAN_IP:5173
-BACKEND_URL=http://YOUR_COMPUTER_LAN_IP:3000
+PUBLIC_APP_URL=http://localhost:5173
+BACKEND_URL=http://localhost:3000
 MOBILE_REDIRECT_URI=devcard://oauth/callback
 
 # ─── Server ───
 PORT=3000
-NODE_ENV=development
+NODE_ENV=development

README.md

@@ -73,6 +73,11 @@ docker compose up -d
 # Copy environment config
 cp .env.example .env
 
+# ⚠️ Replace secret placeholders before starting the server:
+# JWT_SECRET  → node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+# ENCRYPTION_KEY → node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+# Paste the generated values into your .env file. Never use placeholders in production.
+
 # Run database migrations
 pnpm db:migrate