From 82f35161667c7fdc5df1d945543d5d0a44bda61e Mon Sep 17 00:00:00 2001 From: GGPOShadows <187427758+GGPOShadows@users.noreply.github.com> Date: Sat, 19 Sep 2026 22:55:56 -0700 Subject: [PATCH] fix(security): ignore the whole dotenv ladder, not just .env .gitignore listed only the bare filename `.env`, but the app reads four credential files, not one. scripts/setup-doctor.mjs:92 walks `['.env', '.env.local', `.env.${mode}`, `.env.${mode}.local`]`, and server/standalone/vite.config.js:11 calls Vite's `loadEnv(mode, root, '')`, which reads the same ladder. gitignore matches literally, so three of those four files were committable. A key placed in .env.local is fully live for the app -- the doctor reports it as configured and the provider proxies use it -- while `git add -A` stages it. Verified on a clean checkout of main: .env ignored .env.local COMMITTABLE .env.production COMMITTABLE .env.production.local COMMITTABLE This matters more than usual here because the in-app Provider Settings panel trains people to keep real keys in the checkout rather than in a shell profile, and because the repository has ~7.7k forks that inherit the same gap. Replaces the single `.env` entry with `.env` plus `.env.*`, and re-includes `.env.example` with a negation so the tracked template is unaffected. Deliberately scoped to the dotenv ladder alone. Other credential-bearing artifacts (a repo-local OPENSKY_CREDENTIALS_FILE, *.pem/*.key) are a separate question and are left for a follow-up rather than widened here. Co-Authored-By: Claude Opus 5 --- .gitignore | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitignore b/.gitignore index 491a82c15..1a64fff39 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,13 @@ node_modules dist +# Credential files. `.env` alone is not enough: Vite's loadEnv (see +# server/standalone/vite.config.js) and scripts/setup-doctor.mjs both read the +# full dotenv ladder — .env, .env.local, .env. and .env..local — +# so a key placed in any of them is live for the app. Only .env was ignored, +# leaving the other three committable. .env.example is the tracked template. .env +.env.* +!.env.example *.log screenshots/ qa-shots/