GameMatch is a personal prototype application. Access to the deployed application is intentionally restricted by an email allowlist.

Security review currently focuses on:

• Supabase Auth session handling
• Backend API authorization
• Environment variable handling
• Accidental secret exposure in repository files
• Abuse prevention for paid API providers

Do not commit real values for:

• LLM provider API keys
• Tavily or Serper API keys
• Steam API keys
• Supabase service-role keys
• OAuth client secrets
• Cloud provider credentials

Only .env.example files should be committed. Real values must be stored in local .env files or hosting provider environment variables.

Run these checks before sharing or submitting the repository:

git status --short
git grep -n -I -E "sk-|ghp_|AIza|ya29\\.|AWS_SECRET_ACCESS_KEY|BEGIN .*PRIVATE KEY"
npm run --prefix web typecheck
npm run --prefix web lint
npm run --prefix web build
cd backend && .venv/bin/python -m compileall app scripts/evaluate_prompts.py

The grep command can produce false positives for documentation examples. Review any hits manually.

Report security issues privately to the repository owner instead of opening a public issue with sensitive details.