chore: secure GitHub Pages deploy and harden client secret handling

- add GitHub Pages workflow
- add gitleaks workflow to scan pushes/PRs for leaked secrets
- remove client-side logs that exposed env/session/debug info
- document secure GitHub Pages + Supabase setup in README

Author: Tuvudel

.github/workflows/deploy-pages.yml

@@ -0,0 +1,60 @@
+name: Deploy to GitHub Pages
+
+on:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Pages
+        id: pages
+        uses: actions/configure-pages@v5
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build -- --base "${{ steps.pages.outputs.base_path }}"
+        env:
+          VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }}
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
+
+      - name: SPA fallback for direct route loads
+        run: cp dist/index.html dist/404.html
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: dist
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/secret-scan.yml

@@ -0,0 +1,21 @@
+name: Secret Scan
+
+on:
+  pull_request:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -19,6 +19,7 @@ A web application for mapping and visualizing data using Supabase and React.
 - [Schema Overview](#schema-overview)
 - [Quick Start](#quick-start)
 - [Backend Mode: Local vs Online](#backend-mode-local-vs-online)
+- [GitHub Pages Deployment](#github-pages-deployment)
 - [Database Management](#database-management)
 - [Development Commands](#development-commands)
 - [Dev Tips](#dev-tips)
@@ -99,12 +100,14 @@ Best for: Production, staging, or if you don't want to run Docker locally.
 
 5. **Seed test data** (optional):
    - Go to **Authentication** → **Users** → **Add User**
-   - Create a user with email `test@gmail.com` and password `password`
+   - Create a user with your own email and a strong password
+   - In `supabase/seed_data.sql`, set `target_email` to that email
    - Go to **SQL Editor** and run the contents of `supabase/seed_data.sql`
-   - The script automatically finds the test user and creates:
+   - The script creates:
      - **Testimony** project
      - **Pink Line** project
-     - Adds the test user as an editor to both projects
+     - **Memorial Sites** project
+     - Adds your selected user as an editor to all projects
 
 ### Option B: Local Mode (Supabase Local)
 
@@ -135,30 +138,36 @@ Local mode runs Supabase services in Docker containers on your machine.
    supabase db reset
    ```
 
-   This creates a test user and project automatically.
+   This creates a local-only test user and project automatically.
+
+## GitHub Pages Deployment
+
+This repo includes a GitHub Pages workflow at `.github/workflows/deploy-pages.yml`.
 
 ## Database Management
 
 ### Test User Credentials
 
-The seed file creates a test user you can use immediately (both local and cloud):
+`supabase/seed.sql` creates a local development test user:
 
 | Field    | Value            |
 | -------- | ---------------- |
 | Email    | `test@gmail.com` |
 | Password | `password`       |
 
-**Local mode**: This user is automatically added as owner of a "Test Project" when you run `supabase db reset`.
+**Local mode only**: This user is automatically added as owner of a "Test Project" when you run `supabase db reset`.
 
-**Cloud mode**: After creating the user via Dashboard, run `supabase/seed_data.sql` to add the user as an editor to "Testimony" and "Pink Line" projects.
+**Cloud mode**: Do not use shared demo credentials. Create a user with your own email and strong password, set `target_email` in `supabase/seed_data.sql`, then run it.
 
 ### Database Reset (Cloud)
 
 If you need to completely reset your cloud database:
 
 1. Go to **SQL Editor** in your Supabase dashboard
 2. Run `supabase/nuclear_reset.sql` to drop everything and recreate the schema
-3. Run `supabase/seed_data.sql` to add test data (after creating the test user)
+3. Create a real user in Auth (your email + strong password)
+4. Set `target_email` in `supabase/seed_data.sql`
+5. Run `supabase/seed_data.sql` to add project data and memberships
 
 ### Applying Migrations
 

src/config.ts

@@ -1,13 +1,9 @@
-if (!import.meta.env.VITE_SUPABASE_ANON_KEY) {
-  alert("VITE_SUPABASE_ANON_KEY is required");
-  throw new Error("VITE_SUPABASE_ANON_KEY is required");
-}
-if (!import.meta.env.VITE_SUPABASE_URL) {
-  alert("VITE_SUPABASE_URL is required");
-  throw new Error("VITE_SUPABASE_URL is required");
+const supabaseAnonKey = import.meta.env.VITE_SUPABASE_ANON_KEY;
+const supabaseUrl = import.meta.env.VITE_SUPABASE_URL;
+
+if (!supabaseAnonKey || !supabaseUrl) {
+  throw new Error("Missing required application configuration.");
 }
 
-console.log(import.meta.env.VITE_SUPABASE_ANON_KEY);
-console.log(import.meta.env.VITE_SUPABASE_URL);
-export const SUPABASE_ANON_KEY = import.meta.env.VITE_SUPABASE_ANON_KEY;
-export const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL;
+export const SUPABASE_ANON_KEY = supabaseAnonKey;
+export const SUPABASE_URL = supabaseUrl;

src/pages/HomePage.tsx

@@ -10,7 +10,6 @@ const HomePage = () => {
   const navigate = useNavigate();
 
   useEffect(() => {
-    console.log("Current User:", session || "None");
     if (session) {
       navigate("/projects-page");
     }

src/pages/MapPage/PinkLineMapPage.tsx

@@ -44,7 +44,6 @@ const PinkLineMapPage = () => {
       try { map.removeLayer(routeLineRef.current); } catch (_) { /* already gone */ }
       routeLineRef.current = null;
     }
-    console.log(`[PinkLine] Cleared ${count} route layers`);
   };
 
   useEffect(() => {
@@ -126,7 +125,6 @@ const PinkLineMapPage = () => {
         .then((geojson: GeoJSON.FeatureCollection) => {
           if (!mapRef.current) return;
           defaultLinePathsRef.current = parseDefaultLinePaths(geojson);
-          console.log(`[PinkLine] Base line loaded: ${defaultLinePathsRef.current.length} paths`);
           setDefaultLineLoaded(true);
         })
         .catch((err) => console.error("Failed to load default pink line:", err));
@@ -179,8 +177,6 @@ const PinkLineMapPage = () => {
     if (hasBase) {
       const userPoints = nodes.map((n) => [n.lat, n.lng] as [number, number]);
       const { solid, dashed } = buildIntegratedRoute(basePaths, userPoints);
-      console.log(`[PinkLine] Rendering ${solid.length} solid + ${dashed.length} dashed segments for ${nodes.length} nodes`);
-
       const solidStyle: L.PolylineOptions = { color: "#FF69B4", weight: 5, opacity: 0.9 };
       const dashedStyle: L.PolylineOptions = { color: "#FF69B4", weight: 5, opacity: 0.9, dashArray: "10, 10" };
 

src/pages/ProjectsPage.tsx

@@ -24,7 +24,6 @@ const ProjectsPage = () => {
           await ensureMemorialSitesProjectForUser(user.id);
         }
         const data = await loadProjects();
-        console.log("Loaded projects:", data);
         setProjects(data || []);
       } catch (err) {
         setError(err.message);

src/supabase/features.ts

@@ -55,7 +55,6 @@ export async function updateGeometry(id: number, geom: GeoJSON) {
 }
 
 export async function deleteGeometry(id: number) {
-  console.log("Deleting geometry with ID:", id);
   const { error } = await supabase.from("geo_features").delete().eq("id", id);
   if (error) throw error;
 }

supabase/seed.cloud.sql

@@ -3,22 +3,38 @@
 --
 -- BEFORE RUNNING THIS:
 --   1. Go to Authentication → Users → Add User
---   2. Create user with email: test@gmail.com, password: password
---   3. The script will automatically find the user by email
+--   2. Create a real user with your own email + strong password
+--   3. Set target_email below to that user's email
+--   4. Do not use shared test credentials in cloud environments
 
 DO $$
 DECLARE
+    target_email text := 'CHANGE_ME_EMAIL@example.com';
     test_user_id uuid;
 BEGIN
-    -- Find test user by email
+    IF target_email = 'CHANGE_ME_EMAIL@example.com' THEN
+        RAISE EXCEPTION 'Set target_email in supabase/seed.cloud.sql before running this script';
+    END IF;
+
+    -- Find user by email
     SELECT id INTO test_user_id 
     FROM auth.users 
-    WHERE email = 'test@gmail.com' 
+    WHERE lower(email) = lower(target_email)
     LIMIT 1;
 
     IF test_user_id IS NULL THEN
-        RAISE EXCEPTION 'Test user not found. Please create user with email test@gmail.com via Dashboard first';
+        RAISE EXCEPTION 'User not found. Please create user with email % via Dashboard first', target_email;
     END IF;
+    -- Create Memorial Sites project
+    INSERT INTO public.projects (id, name, description, created_at)
+    VALUES (
+        '33333333-3333-3333-3333-333333333333',
+        'Memorial Sites',
+        'אתרי הנצחה',
+        now()
+    )
+    ON CONFLICT (id) DO NOTHING;
+    
 
     -- Create Testimony project
     INSERT INTO public.projects (id, name, description, created_at)
@@ -40,7 +56,7 @@ BEGIN
     )
     ON CONFLICT (id) DO NOTHING;
 
-    -- Add test user as editor to Testimony project
+    -- Add target user as editor to Testimony project
     INSERT INTO public.project_members (project_id, user_id, role)
     VALUES (
         '11111111-1111-1111-1111-111111111111',
@@ -49,7 +65,7 @@ BEGIN
     )
     ON CONFLICT (project_id, user_id) DO UPDATE SET role = 'editor';
 
-    -- Add test user as editor to Pink Line project
+    -- Add target user as editor to Pink Line project
     INSERT INTO public.project_members (project_id, user_id, role)
     VALUES (
         '22222222-2222-2222-2222-222222222222',
@@ -58,5 +74,14 @@ BEGIN
     )
     ON CONFLICT (project_id, user_id) DO UPDATE SET role = 'editor';
 
-    RAISE NOTICE 'Seed data created successfully. Test user ID: %', test_user_id;
+    -- Add target user as editor to Memorial Sites project
+    INSERT INTO public.project_members (project_id, user_id, role)
+    VALUES (
+        '33333333-3333-3333-3333-333333333333',
+        test_user_id,
+        'editor'
+    )
+    ON CONFLICT (project_id, user_id) DO UPDATE SET role = 'editor';
+
+    RAISE NOTICE 'Seed data created successfully. User ID: %', test_user_id;
 END $$;

supabase/seed.sql

@@ -1,5 +1,6 @@
 -- Local development seed file
 -- Usage: supabase db reset (runs migrations + seed automatically)
+-- NOTE: This file is for local development only. Do not use these credentials in cloud/prod.
 --
 -- Test user credentials:
 --   Email: test@gmail.com