# Secrets check

Scanned 2 files (no git found, used .gitignore rules).
High: 2 | Medium: 3 | Low: 1

## High

- **.env.local** (env-file-not-ignored): This env file is not in .gitignore, so the next `git add .` commits it.
  - Fix: Add .env* (and !.env.example) to .gitignore.
- **.env.local:2** (public-env-secret): NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY is bundled into the browser (the NEXT_PUBLIC_ prefix does that). Anyone can read it in the page source.
  - Fix: Rename to SUPABASE_SERVICE_ROLE_KEY (no NEXT_PUBLIC_ prefix), read it only in server code, and rotate it if it was ever deployed.

## Medium

- **.env.local:3** (env-value, fake-... (21 chars)): STRIPE_SECRET_KEY has a value in an env file git will pick up.
  - Fix: Keep real values only in ignored files (.env.local) and in your host's env settings.
- **.gitignore** (no-gitignore): No .gitignore with rules. Env files, build output, and node_modules can all end up committed.
  - Fix: Create .gitignore with at least: .env*, !.env.example, node_modules, .next, .vercel
- **app/api/pay.ts:2** (hardcoded-secret, let... (12 chars)): adminPassword is set to a hardcoded value in code.
  - Fix: Read it from an env var instead, for example process.env.ADMIN_PASSWORD.

## Low

- **app/api/pay.ts:1** (stripe-test-key, sk_tes... (34 chars)): Found a Stripe test secret key. It cannot move real money, but keys belong in env vars, not code.
  - Fix: Move it to an env var, then rotate it in the provider's dashboard. Assume a committed key is already copied.