Remove hardcoded secrets, read from env vars, and add gitleaks guards

.github/workflows/deploy.yml

@@ -12,26 +12,26 @@ jobs:
 
       - name: Configure AWS
         env:
-          AWS_ACCESS_KEY_ID: AKIA5J7K2QX9WZ8RTYUP
-          AWS_SECRET_ACCESS_KEY: aB3dEfGh1jKlMnOpQrStUvWxYz0123456789AbCd
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
         run: |
           aws s3 sync ./frontend/dist s3://timesheet-app-prod
 
       - name: Publish release notes to Slack
         env:
-          SLACK_BOT_TOKEN: xoxb-2456123478901-2456987654321-Ab3Cd4Ef5Gh6Ij7Kl8Mn9Op0
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         run: |
           ./scripts/notify-slack.sh
 
       - name: Tag release in GitHub
         env:
-          GITHUB_PAT: ghp_A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8
+          GITHUB_PAT: ${{ secrets.RELEASE_TAGGING_PAT }}
         run: |
           ./scripts/tag-release.sh
 
       - name: Charge billing webhook
         env:
-          STRIPE_SECRET_KEY: sk_live_51Mz7QkJ2eR8nT4uV6wX9yA1bC3dE5fG7hI
+          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
         run: |
           ./scripts/reconcile-billing.sh

.github/workflows/gitleaks.yml

@@ -0,0 +1,28 @@
+name: Gitleaks
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    env:
+      GITLEAKS_VERSION: 8.30.0
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz gitleaks
+          sudo mv gitleaks /usr/local/bin/gitleaks
+          gitleaks version
+
+      - name: Run gitleaks (working tree)
+        run: gitleaks detect --no-git --redact --verbose --exit-code 1

.gitignore

@@ -0,0 +1,6 @@
+# Environment variable files (never commit real values; templates are allowed)
+.env
+.env.*
+*.env
+!.env.example
+!*.env.example

.pre-commit-config.yaml

@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks

backend/.env.example

@@ -11,3 +11,7 @@ JWT_SECRET=your-super-secret-jwt-key-change-this-in-production-min-32-chars
 # Database Configuration (using SQLite in-memory as specified)
 # No database configuration needed for in-memory SQLite
 # For production persistence, consider using file-based SQLite instead
+
+# Production-only configuration (required by backend/src/config/production.js)
+DATABASE_URL=<set-in-environment>
+SENDGRID_API_KEY=<set-in-environment>

backend/src/config/production.js

@@ -1,16 +1,30 @@
 // Production configuration
-// NOTE: replace with environment variables before GA.
+// All secrets are read from environment variables (or a secrets manager
+// that injects them as env vars). No secret values may be hardcoded here.
+
+function requireEnv(name) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`Missing required environment variable: ${name}`);
+  }
+  return value;
+}
 
 module.exports = {
   jwt: {
-    // hardcoded signing secret (should be moved to env/secret manager)
-    secret: 'zt7Qk29 eR8nT4uV6wX9yA1bC3dE5fG7hI0jK2lM4nO6pQ8rS'.replace(' ', ''),
+    get secret() {
+      return requireEnv('JWT_SECRET');
+    },
     expiresIn: '24h',
   },
   database: {
-    url: 'postgres://tsapp_admin:Pr0d_DbP@ss_9f3a2c7b@db.internal.timesheet.io:5432/timesheet',
+    get url() {
+      return requireEnv('DATABASE_URL');
+    },
   },
   sendgrid: {
-    apiKey: 'SG.aB3dEfGh1jKlMnOpQ.rStUvWxYz0123456789AbCdEfGhIjKlMnOpQrStUvW',
+    get apiKey() {
+      return requireEnv('SENDGRID_API_KEY');
+    },
   },
 };

frontend/.gitignore

@@ -8,6 +8,9 @@ pnpm-debug.log*
 lerna-debug.log*
 
 node_modules
+.env
+.env.*
+!.env.example
 dist
 dist-ssr
 *.local