chore: add security workflow and update gitignore to exclude sensitiv…

[jumalaw98]

… the environment and credential files

---

Summary by cubic

Added a security workflow that runs on all pushes, blocks committed .env files (and secret-like templates), and runs heavy scans only on dev/main. Removed a checked-in .env and expanded .gitignore to cover more secrets and local data.

• New Features

  • GitHub Actions: trigger on all pushes; run audit/codeql only on dev/main; always run check-env to fail on tracked .env and validate .env.* templates for real keys.
  • .gitignore/CI: ignore .env, .env.* (keep !.env.example), *.local, *.pem, *.key, *.crt, *.sqlite, *.dump, *.secret, secrets.json, auth.json, supabase/.temp/, supabase/.branches/; semantic PRs now allow security type.

• Migration

  • If a .env is tracked, remove it: git rm --cached ; ensure .env.example only has placeholders.

^{Written for commit d84fff2. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sytcolabs	Ready	Preview, Comment	Apr 16, 2026 3:58pm

[github-actions]

Changelog preview

This is what the changelog entry will look like once this PR is merged.

No conventional commits found in this PR.

[cubic-dev-ai]

2 issues found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/security.yml">

<violation number="1" location=".github/workflows/security.yml:193">
P1: This check only catches files named exactly `.env`, so tracked secret-bearing variants like `.env.local` or `.env.production` will slip through.</violation>
</file>

<file name=".gitignore">

<violation number="1" location=".gitignore:28">
P2: `.env*` also ignores `.env.example`, which this repo's setup docs rely on as the committed environment template.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud