fix(security): sanitize environment files and update gitignore

Author: josegomez-dev

.gitignore

@@ -10,12 +10,14 @@ out/
 build/
 dist/
 
-# Environment variables
+# Environment variables - CRITICAL SECURITY
 .env
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
+.env.*
+!.env.example
+env.local
+env.production
+env.development
+env.test
 
 # TypeScript
 *.tsbuildinfo

env.example

@@ -53,8 +53,8 @@ NEXT_PUBLIC_DEBUG_MODE=false
 
 # JWT and session secrets (server-side only)
 # Generate with: openssl rand -base64 32
-JWT_SECRET=jwt_n3XuS
-SESSION_SECRET=session_n3XuS
+JWT_SECRET=your_jwt_secret_here_generate_with_openssl_rand_base64_32
+SESSION_SECRET=your_session_secret_here_generate_with_openssl_rand_base64_32
 
 # ============================================================================
 # FEATURE FLAGS
@@ -94,13 +94,14 @@ NEXT_PUBLIC_FRAME_OPTIONS_ENABLED=true
 # ============================================================================
 
 # Firebase project configuration
-NEXT_PUBLIC_FIREBASE_API_KEY=AIzaSyCVq9jAmW912-4SClPuip6bbPy5fnWE7no
-NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=nexus-55966.firebaseapp.com
-NEXT_PUBLIC_FIREBASE_PROJECT_ID=nexus-55966
-NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=nexus-55966.firebasestorage.app
-NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=48419163339
-NEXT_PUBLIC_FIREBASE_APP_ID=1:48419163339:web:637eadbce2dadb24605f4e
-NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID=G-80T26CG9PM
+# Get these values from your Firebase Console > Project Settings > General
+NEXT_PUBLIC_FIREBASE_API_KEY=your_firebase_api_key_here
+NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=your-project-id.firebaseapp.com
+NEXT_PUBLIC_FIREBASE_PROJECT_ID=your-project-id
+NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=your-project-id.firebasestorage.app
+NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=your_messaging_sender_id
+NEXT_PUBLIC_FIREBASE_APP_ID=your_firebase_app_id
+NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID=your_measurement_id
 
 # Firebase emulator configuration (development only)
 FIREBASE_USE_EMULATOR=false
@@ -114,7 +115,7 @@ FIREBASE_AUTH_EMULATOR_HOST=localhost:9099
 NEXT_PUBLIC_ANALYTICS_ENABLED=false
 NEXT_PUBLIC_ANALYTICS_ID=nexus-55966
 NEXT_PUBLIC_ERROR_REPORTING_ENABLED=true
-NEXT_PUBLIC_ERROR_REPORTING_API_KEY=fS7lRrskKyoJwOg2QAaGdjFNz4ua1YXH
+NEXT_PUBLIC_ERROR_REPORTING_API_KEY=your_error_reporting_api_key_here
 
 # ============================================================================
 # AI ASSISTANT CONFIGURATION