| Artifact | Why |
|---|---|
.env, .env.gcp, any .env.* except *.example |
API keys, Firebase keys, Stripe secrets |
credentials.json, *-service-account*.json, firebase-adminsdk*.json |
GCP / Firebase Admin |
*.pem, *.p12, *.key, token.json |
TLS and OAuth material |
| Qdrant data, workspace registries with real tenant data | Customer content |
.gitignore is configured for the above. Always copy from .env.example or .env.gcp.example locally.
git status
git diff --staged | rg -i 'api[_-]?key|secret|password|Bearer sk-|AIza' || trueIf anything matches, remove it and rotate the exposed key.
- Prefer GCP Secret Manager for
OPENROUTER_API_KEY,RAG_API_KEY,STRIPE_*on Cloud Run (deploy/gcp/deploy.sh). FIREBASE_WEB_API_KEYis a public client key; still avoid committing if you use project-specific quotas.- See docs/deployment/google-cloud.md and ADR-017.