studio/.env.example at main · QAStudio-Dev/studio · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149

# ===== DEPLOYMENT MODE =====
# Set to true for self-hosted deployments (unlocks all features, no Stripe required)
# Self-hosted mode provides unlimited users, projects, and all premium features for free
# See SELF_HOSTED.md for complete documentation
# Default: false (SaaS mode with payment/subscription checks)
SELF_HOSTED=false

# ===== AUTHENTICATION SECRETS =====
# CRITICAL: These MUST be set to cryptographically secure random values in production
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"

# Session Secret (for HMAC signing of session tokens)
# REQUIRED in production - no default allowed
SESSION_SECRET=your_base64_secret_here_generate_with_crypto_randomBytes

# Password Reset Secret (for HMAC signing of reset tokens)
# Optional - falls back to SESSION_SECRET if not set
# Recommended to use a separate value in production
RESET_SECRET=your_base64_secret_here_generate_with_crypto_randomBytes

# ===== STRIPE CONFIGURATION (SAAS MODE ONLY) =====
# NOT REQUIRED if SELF_HOSTED=true
# Only needed for hosted SaaS deployments with payment processing

# Stripe Keys
# Get from Stripe Dashboard -> Developers -> API Keys
STRIPE_SECRET_KEY=sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Stripe Webhook Secret (for subscription events)
# Get from Stripe Dashboard -> Developers -> Webhooks -> Signing Secret
STRIPE_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Stripe Price IDs (create products in Stripe Dashboard first)
STRIPE_PRICE_ID_PRO_MONTHLY=price_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
STRIPE_PRICE_ID_PRO_YEARLY=price_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Public Base URL (for redirects)
PUBLIC_BASE_URL=http://localhost:5173

# Public Stripe Key
PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PUBLIC_STRIPE_PRICE_ID_PRO_MONTHLY=price_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PUBLIC_STRIPE_PRICE_ID_PRO_YEARLY=price_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Vercel Blob Storage (for test attachments - screenshots, videos, traces)
# Get from Vercel Dashboard -> Storage -> Blob -> Connect -> Read/Write Token
# REQUIRED: All attachments are stored in Vercel Blob (no local storage)
BLOB_READ_WRITE_TOKEN=vercel_blob_rw_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# ===== EMAIL CONFIGURATION (SMTP via Nodemailer) =====
# CRITICAL SECURITY NOTES:
# - NEVER commit actual credentials to version control
# - Rotate credentials immediately if exposed or suspected of compromise
# - In production, use environment-specific secrets management:
#   - AWS Secrets Manager, HashiCorp Vault, or similar
#   - Vercel Environment Variables with encryption
# - Regularly audit email sending logs for unauthorized usage

# For Google Workspace/Gmail SMTP:
# 1. Enable 2-Factor Authentication on your Google account
# 2. Generate an App Password: https://myaccount.google.com/apppasswords
# 3. Use the app password (not your regular password) below
# 4. IMPORTANT: Never use your main account password here

# Required: Your email account credentials
# WARNING: These credentials grant full email sending access
EMAIL_USER=ben@qastudio.dev
EMAIL_PASSWORD=your_16_char_app_password_here  # Use app-specific password, NOT account password

# Optional: SMTP server settings (defaults shown for Gmail)
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=587
EMAIL_SECURE=false  # false for port 587 (STARTTLS), true for port 465 (SSL/TLS)

# Optional: Custom "From" address with display name
# If not set, uses EMAIL_USER as the from address
# EMAIL_FROM=QA Studio <ben@qastudio.dev>

# Email addresses for system notifications
SALES_EMAIL=ben@qastudio.dev  # Receives enterprise inquiry notifications

# Public app URL (used in email links, defaults to https://qastudio.dev)
PUBLIC_APP_URL=https://qastudio.dev

# Encryption Key (for encrypting sensitive integration credentials)
# Generate with: openssl rand -hex 32
# IMPORTANT: Keep this secret and never commit to version control
# Required for: Jira API tokens, Slack webhooks, and other third-party credentials
ENCRYPTION_KEY=your_64_character_hex_string_here_generate_with_openssl_rand_hex_32

# URL Signing Secret (for time-limited signed URLs to trace files)
# Generate with: openssl rand -hex 32
# IMPORTANT: Keep this secret and never commit to version control
# Required for: Generating secure signed URLs for Playwright trace viewer
URL_SIGNING_SECRET=your_64_character_hex_string_here_generate_with_openssl_rand_hex_32

# TOTP Encryption Key (for encrypting shared authenticator token secrets)
# Generate with: openssl rand -hex 32
# IMPORTANT: Keep this secret and never commit to version control
# Required for: Encrypting TOTP secrets for shared 2FA tokens
TOTP_ENCRYPTION_KEY=your_64_character_hex_string_here_generate_with_openssl_rand_hex_32

# Upstash Redis (for caching API responses)
# Get from Vercel Dashboard -> Storage -> Redis (Upstash) -> Connect -> REST API
# Optional in development (caching will be disabled if not set)
# Required in production for optimal performance
KV_REST_API_URL=https://your-redis-instance.upstash.io
KV_REST_API_TOKEN=your_upstash_token_here

# Cron Secret (for securing scheduled job endpoints)
# Generate with: openssl rand -hex 32
# IMPORTANT: Keep this secret and never commit to version control
# Required for: Vercel Cron jobs to authenticate when calling cron endpoints
CRON_SECRET=your_64_character_hex_string_here_generate_with_openssl_rand_hex_32

# OpenAI API Key (for AI trace analysis and test failure diagnostics)
# Get from OpenAI Platform -> API Keys (https://platform.openai.com/api-keys)
# Required for: AI-powered trace analysis, root cause detection, and fix suggestions
# Free tier: 10 analyses per month | Pro tier: Unlimited analyses
OPENAI_SECRET_KEY=sk-proj-xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# ===== RATE LIMITING CONFIGURATION =====
# Optional: Override default rate limits (production-hardened defaults shown)
# All values can be adjusted based on your infrastructure capacity and security requirements

# Signup rate limits (prevent account creation spam)
# RATE_LIMIT_SIGNUP_MAX_ATTEMPTS=3
# RATE_LIMIT_SIGNUP_WINDOW_HOURS=1

# Login rate limits (prevent brute force attacks)
# RATE_LIMIT_LOGIN_MAX_ATTEMPTS=5
# RATE_LIMIT_LOGIN_WINDOW_MINUTES=15

# Enterprise inquiry rate limits (prevent contact form spam)
# RATE_LIMIT_ENTERPRISE_INQUIRY_MAX_ATTEMPTS=5
# RATE_LIMIT_ENTERPRISE_INQUIRY_WINDOW_HOURS=1
# RATE_LIMIT_ENTERPRISE_INQUIRY_DUPLICATE_WINDOW_HOURS=24

# In-memory rate limiter cleanup interval (minutes)
# RATE_LIMIT_CLEANUP_INTERVAL_MINUTES=5

# ===== DATABASE BACKUP CONFIGURATION =====
# Backup retention period in days (how long backups are kept before deletion)
# Default: 30 days (GDPR/CCPA compliant retention period)
# Production recommendation: Keep at 30 days for compliance
# Development: Can be reduced to 7 days to save storage
BACKUP_RETENTION_DAYS=30