IMPORTANT: Never commit API keys or sensitive credentials to your repository!

✅ .env file is in .gitignore - your actual keys are safe ✅ .env.example contains only placeholder values ✅ All code uses process.env to read environment variables ✅ No hardcoded credentials in the codebase

This application requires the following environment variables:

1. Copy .env.example to .env:

   cp .env.example .env

2. Fill in your actual values in .env

3. NEVER commit .env to git!

Environment variables are set through the Render dashboard:

• Go to your service settings
• Click "Environment"
• Add each variable with its actual value
• Render keeps these secure and encrypted

1. Never commit .env files

   • Already in .gitignore
   • Double-check before pushing

2. Use strong secrets

   • Generate random strings for SECRET
   • Use tools like https://randomkeygen.com/

3. Rotate keys regularly

   • Change API keys periodically
   • Update in hosting platform dashboard

4. Limit API key permissions

   • Use read-only keys when possible
   • Monitor API usage

5. Keep dependencies updated

   • Run npm audit regularly
   • Update packages with security fixes

If you accidentally commit API keys:

1. Immediately revoke the exposed key

   • Go to the API provider (BALLDONTLIE)
   • Generate a new key
   • Delete the old key

2. Remove from git history

   # Remove sensitive file from history
   git filter-branch --force --index-filter \
   "git rm --cached --ignore-unmatch .env" \
   --prune-empty --tag-name-filter cat -- --all
   
   # Force push (be careful!)
   git push origin --force --all

3. Update all deployments

   • Update environment variables in Render
   • Redeploy with new keys

If you discover a security vulnerability:

1. DO NOT open a public issue
2. Email the repository owner directly
3. Provide details about the vulnerability
4. Allow time for a fix before public disclosure

• OWASP API Security
• GitHub Security Best Practices
• Node.js Security Best Practices

Remember: Security is everyone's responsibility. Keep your keys safe! 🔒