security: untrack leaked .env backup, tighten .gitignore (.env/.bak)

b70969f95b33026557b79ba09c3b483d959fd9d5 · 2026-07-29 07:16:46 -0700 · Steve Abrams
Files touched

D .env.bak-basicauth
M .gitignore
Diff

commit b70969f95b33026557b79ba09c3b483d959fd9d5
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 29 07:16:46 2026 -0700

    security: untrack leaked .env backup, tighten .gitignore (.env*/*.bak)
---
 .env.bak-basicauth | 39 ------------------------------------
 .gitignore         | 58 +++++++++++++++++++++++++++---------------------------
 2 files changed, 29 insertions(+), 68 deletions(-)

diff --git a/.env.bak-basicauth b/.env.bak-basicauth
deleted file mode 100644
index 41803ec..0000000
--- a/.env.bak-basicauth
+++ /dev/null
@@ -1,39 +0,0 @@
-DATABASE_URL=postgresql:///animals_directory?host=/tmp&user=stevestudio2
-PGHOST=/tmp
-PGUSER=stevestudio2
-PGDATABASE=animals_directory
-NODE_ENV=development
-PORT=9720
-PUBLIC_BASE_URL=http://localhost:9720
-SESSION_SECRET=183fd8abcd021448e1a33e02bcaf83dd6e1d2f4d1e670f15d21497aea2e95ca5
-ADMIN_EMAIL=steve@designerwallcoverings.com
-ADMIN_PASSWORD=change-me-bootstrap
-AD_PROVIDER=inhouse
-GEORGE_GMAIL_URL=http://localhost:9850
-GEORGE_AUTH=admin:DWSecure2024!
-DOMAIN_SUITE_PROVIDER=godaddy
-
-# --- CAN-SPAM gate (set 2026-06-21, DTD verdict A) ---
-# FROM_NAME: brand-derivable, safe to set; matches the code default in
-# src/lib/weekly_newsletter.js. Setting it does NOT unblock sending.
-GEORGE_FROM_NAME=AnimalsDirectory
-# NEWSLETTER_MAILING_ADDRESS: DELIBERATELY UNSET → weekly_newsletter fails closed.
-# CAN-SPAM 16 C.F.R. § 316.5 + Cal. Bus. & Prof. § 17529.5 require a REAL physical
-# postal address in every commercial email. A fabricated/placeholder address is
-# itself the violation. Steve must supply a verified street address or USPS
-# Form-1583 PO box before any send. GATED — see pending-approval memo.
-# NEWSLETTER_MAILING_ADDRESS=
-
-OPENAI_API_KEY=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
-MOONSHOT_API_KEY=sk-2Onhfw6wu4XDgXJlFYT6ASqI27eU23mmgSbsylaKrqwLXiYg
-
-# Stripe — TEST MODE ONLY for animals (per Steve, 2026-05-11). Live key
-# lives in the master registry under STRIPE_SECRET_KEY but animals is gated
-# to test keys. Run `stripe listen --forward-to localhost:9720/webhooks/stripe`
-# to populate STRIPE_WEBHOOK_SECRET. Add sk_test_… below.
-STRIPE_SECRET_KEY=
-STRIPE_PUBLISHABLE_KEY=
-STRIPE_WEBHOOK_SECRET=
-BASIC_AUTH=admin:DWSecure2024!
-
-GOOGLE_PLACES_API_KEY=AIzaSyB_nA2Ytch4_G3HRzrMEZW8_1_GqAwq8AI
diff --git a/.gitignore b/.gitignore
index 0fc86c9..89828ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,39 +1,39 @@
-node_modules
+
+!public/css/**
+!public/dogpark/**
+!public/js/**
+!public/static/**
+.DS_Store
 .env
+.env.bak-basicauth
 .env.local
-logs/*.log
-public/screenshots/*.png
-public/mockups/*.png
-raw_html/
-tmp/
+.env*
+.next/
 *.bak
-.DS_Store
-
-# 2026-05-03: drop debug-loop log noise (was 3000+ untracked files)
-logs/debug-loop-*/
-logs/animals-debug-loop-*/
-
-# Standing-rule additions (2026-05-07)
+*.bak-*
+*.jpeg
+*.jpg
 *.log
+*.png
 *.pre-*
-dist/
-build/
-.next/
-
-# Generated content — produced by the autonomous agent every cron tick
 # (subsites + screenshots + mockups + uploaded photos + raw JSON).
+# 2026-05-03: drop debug-loop log noise (was 3000+ untracked files)
 # 7,400+ files were leaking into git diff before this rule.
-public/sites/
-public/screenshots/
+# but DO keep CSS/JS we ship
+# Generated content — produced by the autonomous agent every cron tick
+# Standing-rule additions (2026-05-07)
+build/
+dist/
+exports/
+logs/*.log
+logs/animals-debug-loop-*/
+logs/debug-loop-*/
+node_modules
 public/mockups/
+public/mockups/*.png
+public/screenshots/
+public/screenshots/*.png
+public/sites/
 public/uploads/
 raw_html/
-exports/
-*.png
-*.jpg
-*.jpeg
-# but DO keep CSS/JS we ship
-!public/css/**
-!public/js/**
-!public/dogpark/**
-!public/static/**
+tmp/
← 52183c3 migrate GoDaddy auth → Bearer PAT (TK-10 key rotation); sso- · back to Animals · auto-save: 2026-07-29T08:37:25 (1 files) — desk-homes-check. 1b8aa98 →