This document outlines best practices for keeping sensitive data secure in your Pixel Verse project.

Your project is currently SAFE ✅

• No API keys found in code
• No hardcoded credentials
• No sensitive tokens exposed

Never hardcode these in your files:

• API keys
• Secret tokens
• Passwords
• Database credentials
• Payment gateway keys
• Private keys
• Email credentials
• OAuth secrets

Instead of hardcoding:

// ❌ BAD - Don't do this
const apiKey = "sk_live_abc123xyz789";

Use environment variables:

// ✅ GOOD - Do this
const apiKey = process.env.API_KEY;

Always include sensitive files in .gitignore:

.env
.env.local
config.js
secrets.js
credentials.json

Create a .env file (NOT committed to Git):

API_KEY=your_actual_api_key_here
DATABASE_URL=your_database_connection

Provide a .env.example template (safe to commit):

API_KEY=your_api_key_here
DATABASE_URL=your_database_url_here

# Remove the file
git rm --cached .env

# Update .gitignore
echo ".env" >> .gitignore

# Commit the changes
git add .gitignore
git commit -m "Remove sensitive file and update .gitignore"
git push

# Remove file from all commits
git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch .env" \
  --prune-empty --tag-name-filter cat -- --all

# Force push
git push origin --force --all

# Install BFG (easier than filter-branch)
# Download from: https://rtyley.github.io/bfg-repo-cleaner/

# Remove file
bfg --delete-files .env

# Clean up
git reflog expire --expire=now --all
git gc --prune=now --aggressive

# Force push
git push origin --force --all

⚠️ IMPORTANT: After removing secrets, immediately rotate/regenerate any exposed keys!

Before pushing to GitHub:

• Check for hardcoded API keys
• Check for passwords in code
• Verify .env is in .gitignore
• Review git status before committing
• Use git diff to check changes
• Never commit database credentials
• Use environment variables for secrets
• Keep .env.example updated (with dummy values)

# Search for common patterns
git grep -i "api_key"
git grep -i "secret"
git grep -i "password"
git grep -i "token"

# Install git-secrets
git secrets --install
git secrets --scan

# Or use gitleaks
gitleaks detect --source .

• GitHub Security Best Practices
• OWASP Security Guidelines
• Git Secrets Tool
• Gitleaks Scanner

If you've exposed sensitive data:

1. Immediately revoke/rotate the compromised keys
2. Check if anyone has accessed them (check logs)
3. Clean Git history using methods above
4. Update all affected services
5. Enable 2FA where possible

Remember: Prevention is better than cure! Always double-check before pushing to GitHub. 🔒