Remove committed secrets and add gitleaks pre-commit + CI gate

[devin-ai-integration]

Summary

Weekly gitleaks sweep found 5 hardcoded secrets in the working tree (10 in git history). This PR removes them from the code going forward and adds guards so they cannot be re-committed. All leaked values must still be rotated — they remain in git history until a separate history purge.

What was found (values redacted)

Working tree (gitleaks --no-git, v8.30.1):

File:line	Type
.github/workflows/deploy.yml:16	AWS secret access key (AWS_SECRET_ACCESS_KEY: ****)
.github/workflows/deploy.yml:23	Slack bot token (xoxb-****)
.github/workflows/deploy.yml:29	GitHub PAT (ghp_****)
.github/workflows/deploy.yml:35	Stripe live secret key (sk_live_****)
backend/src/config/production.js:14	JWT secret (JWT_SECRET: '****'), plus Postgres URL with password and SendGrid key on adjacent lines

History-only (already removed from the tree, still in commits): k8s/secret.yaml:14, .github/workflows/sonar-devin-fix.yml:44,64, and earlier revisions of production.js.

backend/.env is already gitignored and untracked. frontend/.env was tracked but only held the non-secret VITE_API_URL; it's removed here so no .env file is tracked.

Changes

• deploy.yml: literal values -> ${{ secrets.AWS_ACCESS_KEY_ID }}, ${{ secrets.SLACK_BOT_TOKEN }}, ${{ secrets.GH_DEPLOY_TOKEN }}, ${{ secrets.STRIPE_SECRET_KEY }} etc.
• backend/src/config/production.js: hardcoded literals replaced with a fail-fast reader — no default secret fallback:

  function requireEnv(name) {
    const v = process.env[name];
    if (!v) throw new Error(`Missing required environment variable: ${name}`);
    return v;
  }
  get JWT_SECRET() { return requireEnv('JWT_SECRET'); }

• .gitignore (root) + frontend/.gitignore: ignore .env, .env.*, *.env; keep !.env.example / !*.env.example.
• backend/.env.example: placeholder entries for DATABASE_URL and SENDGRID_API_KEY (JWT_SECRET etc. already present) — placeholders only.
• .pre-commit-config.yaml: gitleaks/gitleaks hook pinned to v8.30.1.
• .github/workflows/gitleaks.yml: runs the gitleaks CLI (--no-git --exit-code 1) on push and pull_request. Uses the CLI rather than gitleaks-action because the action requires a paid GITLEAKS_LICENSE for org repos. Scans the working tree only, since history still contains the old leaks and would fail every build until purged.

Rotation required

Treat every value above as compromised: rotate the AWS key pair, Slack bot token, GitHub PAT, Stripe live key, JWT secret, Postgres password, and SendGrid key, then store the new values in GitHub Actions secrets / the deployment environment. Purging git history (git filter-repo) is a separate follow-up.

Verification

• Post-fix gitleaks detect --no-git: no leaks found.
• cd backend && npm test: 161 passed. cd frontend && npm run lint: clean.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/9461e403807b4d2f8b7e9bddd64dc584
Open in Devin Desktop: https://partner-workshops.devinenterprise.com/desktop/session/9461e403807b4d2f8b7e9bddd64dc584?variant=devin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud