Security: Exposed API Keys and Service Keys in .env File

[purvanshjoshi]

Description

The .env file in the backend directory contains actual API keys and service keys that appear to have been committed to the repository. This includes:

• GROQ_API_KEY
• SUPABASE_SERVICE_KEY (which has full service role access)

These credentials are now exposed and should be rotated immediately.

Evidence

The following file contains sensitive credentials:
`
GITHUB_TOKEN=
GROQ_API_KEY=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

SUPABASE_URL=https://wcskhdvvlnplgynhwfqq.supabase.co
SUPABASE_SERVICE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Indjc2toZHZ2bG5wbGd5bmh3ZnFxIiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImlhdCI6MTc4MTQ0NzM1OCwiZXhwIjoyMDk3MDIzMzU4fQ.nTzsl8XM94t1YPcT1lD-4qzMhEf61oozMLCmHd5PMOQ
`

Proposed Fix

1. Immediately rotate all exposed credentials:

   • Regenerate GROQ_API_KEY at https://console.groq.com/keys
   • Regenerate SUPABASE_SERVICE_KEY in Supabase dashboard
   • Regenerate GITHUB_TOKEN if it was ever committed

2. Update .gitignore:

   • Ensure .env* pattern is used to catch all environment files
   • Add .env.local to .gitignore if not already present

3. Clean git history:

   • Use git filter-branch or BFG Repo Cleaner to remove the .env file from git history
   • Force push to remove the sensitive data from all commits

4. Add pre-commit hooks:

   • Implement detect-secrets or git-secrets to prevent future commits of API keys
   • Add a CI check to scan for secrets in PRs

Acceptance Criteria

1. All exposed credentials are rotated and new ones are generated
2. The .env file is removed from git history
3. .gitignore properly excludes all environment files
4. A pre-commit hook or CI check prevents future secret commits
5. No emojis in any codebase changes or commits

Impact

HIGH - Exposed credentials can lead to:

• Unauthorized access to Groq API (costs)
• Full access to Supabase database (data breach)
• Potential GitHub repository compromise if GITHUB_TOKEN was exposed

[Shivamkumar31]

Hi @purvanshjoshi, I'd like to work on this issue if it's still available.

My plan is to:

• Remove the committed .env file and ensure all environment files are ignored.
• Update the repository to use a .env.example template.
• Add secret scanning (e.g. detect-secrets or gitleaks) to help prevent future secret leaks.
• Document the required environment variables.

I understand that credential rotation and rewriting Git history require maintainer access, so I'll focus on the repository changes and can assist with any additional updates if needed.

Could you please assign this issue to me? Thank you!