security: redact stale leaked OAuth/NextAuth/JWT secrets from GOOGLE_OAUTH_COMPLETE.md doc

81e64f60cc199bca2f89640fac2d7ccfdcbb9d5c · 2026-09-20 12:10:49 -0700 · Steve Abrams

Doc pasted a full .env.local block verbatim. All 3 values are already-rotated
(live .env.local differs), repo has no remote. Runtime (lib/auth.ts) is env-first,
so redacting this doc has zero prod impact. No rotation needed (values dead).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A3PFQP7b2cFzSLAN6gB4ZB

Files touched

M GOOGLE_OAUTH_COMPLETE.md

Diff

commit 81e64f60cc199bca2f89640fac2d7ccfdcbb9d5c
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Sep 20 12:10:49 2026 -0700

    security: redact stale leaked OAuth/NextAuth/JWT secrets from GOOGLE_OAUTH_COMPLETE.md doc
    
    Doc pasted a full .env.local block verbatim. All 3 values are already-rotated
    (live .env.local differs), repo has no remote. Runtime (lib/auth.ts) is env-first,
    so redacting this doc has zero prod impact. No rotation needed (values dead).
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01A3PFQP7b2cFzSLAN6gB4ZB
---
 GOOGLE_OAUTH_COMPLETE.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/GOOGLE_OAUTH_COMPLETE.md b/GOOGLE_OAUTH_COMPLETE.md
index 7bcac00..15f379f 100644
--- a/GOOGLE_OAUTH_COMPLETE.md
+++ b/GOOGLE_OAUTH_COMPLETE.md
@@ -16,14 +16,14 @@ File: `.env.local`
 ```env
 # Google OAuth
 GOOGLE_CLIENT_ID=493480746821-mhpjc0glkkogcf845ubi2hkhksoqj39k.apps.googleusercontent.com
-GOOGLE_CLIENT_SECRET=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
+GOOGLE_CLIENT_SECRET=GOCSPX-<redacted — see .env.local (gitignored) / secrets-manager>
 
 # NextAuth
 NEXTAUTH_URL=https://www.bubbe.ai
-NEXTAUTH_SECRET=fcUUJbsXvU4UWE7n6dgadciBiYknhfN/+qgsr1oqM20=
+NEXTAUTH_SECRET=<redacted — see .env.local (gitignored)>
 
 # JWT Secret
-JWT_SECRET=8Hc1rT/RyAciT6YtpGswMklRERxLgtkABS9csYGInxQ=
+JWT_SECRET=<redacted — see .env.local (gitignored)>
 ```
 
 ### 3. **Files Created**

← e3c809e privacy: add AdSense advertising disclosure (account-ban pre · back to Dear Bubbe Nextjs · security: redact leaked NewsData API key from CLAUDE.md doc 61ea77c →