@smbcloud / pepakbasajawa-web
Code Commits Issues Pulls Cloud Agent CI/CD
development
copilot/add-i18n-support-for-english dependabot/npm_and_yarn/astro-5.16.4 dependabot/npm_and_yarn/katex-0.16.27 dependabot/npm_and_yarn/prettier-3.7.4 dependabot/npm_and_yarn/tailwindcss-4.1.16 dependabot/npm_and_yarn/tailwindcss/vite-4.1.16 dependabot/npm_and_yarn/typescript-eslint-8.46.2 dependabot/npm_and_yarn/typescript-eslint/parser-8.46.2 development main
md 293 lines 7.28 KB
Rendered Raw
1 # Security Guide - Protecting Credentials in Public Repository
2
3 > **⚠️ CRITICAL: This repository (pepakbasajawa-web) is PUBLIC**
4 > All code committed here is visible to everyone on the internet.
5
6 ## 🎯 Quick Security Rules
7
8 ### ❌ NEVER Commit These:
9 - `.env` files
10 - GitHub tokens (ghp_*, github_pat_*)
11 - API keys (Stripe, AWS, etc.)
12 - Passwords
13 - Private keys
14 - Database credentials
15 - Any sensitive configuration
16
17 ### ✅ ALWAYS Do This:
18 - Use environment variables for secrets
19 - Add `.env` to `.gitignore`
20 - Use placeholders in documentation
21 - Review code before committing
22 - Double-check staged files
23
24 ## 🔒 How to Handle Secrets Safely
25
26 ### 1. Local Development
27
28 **Create .env file** (never commit):
29 ```bash
30 # Create .env in project root
31 echo "GITHUB_TOKEN=your_actual_token_here" > .env
32
33 # Verify it's gitignored
34 git status # Should NOT show .env
35 ```
36
37 **Load secrets in code**:
38 ```typescript
39 // ✅ CORRECT: Load from environment
40 const GITHUB_TOKEN = import.meta.env.GITHUB_TOKEN
41
42 // ❌ WRONG: Never hardcode
43 const GITHUB_TOKEN = "ghp_actual_token_here"
44 ```
45
46 ### 2. Documentation
47
48 **Use placeholders**:
49 ```bash
50 # ✅ CORRECT: Placeholder token
51 GITHUB_TOKEN=ghp_your_token_here
52
53 # ❌ WRONG: Real token
54 GITHUB_TOKEN=ghp_s3cr3tt0k3nH3r3XXXXXXXXXX
55 ```
56
57 ### 3. Production Deployment
58
59 **Set environment variables in hosting platform**:
60
61 **Vercel**:
62 ```bash
63 vercel env add GITHUB_TOKEN
64 # Paste token when prompted
65 ```
66
67 **Netlify**:
68 ```bash
69 netlify env:set GITHUB_TOKEN your_token_here
70 ```
71
72 **Or via dashboards**:
73 - Vercel: Project Settings → Environment Variables
74 - Netlify: Site Settings → Environment Variables
75
76 ## 🛡️ Security Checklist
77
78 Before every commit:
79 - [ ] Run `git status` - check what's being committed
80 - [ ] Run `git diff --cached` - review changes
81 - [ ] Verify no `.env` files in staged files
82 - [ ] Search for token patterns: `ghp_`, `sk_live_`, `pk_live_`
83 - [ ] Ensure all secrets use environment variables
84 - [ ] Documentation uses only placeholders
85
86 ## 🚨 If You Accidentally Commit a Secret
87
88 ### Immediate Actions (Within 5 minutes):
89
90 1. **Revoke the secret immediately**:
91 - GitHub: https://github.com/settings/tokens
92 - Stripe: https://dashboard.stripe.com/apikeys
93 - AWS: AWS IAM Console
94
95 2. **Remove from git history**:
96 ```bash
97 # Remove file from git history
98 git filter-branch --force --index-filter \
99 "git rm --cached --ignore-unmatch .env" \
100 --prune-empty --tag-name-filter cat -- --all
101
102 # Force push (be careful!)
103 git push origin --force --all
104 ```
105
106 3. **Generate new secret**:
107 - Create a new token/key immediately
108 - Update `.env` locally
109 - Update production environment variables
110
111 4. **Notify the team**:
112 - Inform relevant team members
113 - Document what happened
114 - Update procedures to prevent recurrence
115
116 ### If More Than 5 Minutes Have Passed:
117
118 **Assume the secret is compromised!**
119 - Revoke immediately
120 - Generate new credentials
121 - Monitor for unauthorized usage
122 - Consider changing related passwords
123 - File incident report if required
124
125 ## 🔧 Setup Pre-Commit Hooks
126
127 Prevent accidents with automated checks:
128
129 ```bash
130 # Configure git to use custom hooks directory
131 git config core.hooksPath .githooks
132
133 # Copy the example hook
134 cp .githooks/pre-commit.example .githooks/pre-commit
135
136 # Make it executable
137 chmod +x .githooks/pre-commit
138 ```
139
140 The pre-commit hook will:
141 - ✅ Block commits with `.env` files
142 - ✅ Detect GitHub token patterns
143 - ✅ Find API key patterns
144 - ✅ Warn about hardcoded passwords
145 - ✅ Check .gitignore configuration
146
147 ## 📋 Project-Specific Security
148
149 ### Desktop Downloads Feature
150
151 **What needs to be secret**:
152 - `GITHUB_TOKEN` - Personal Access Token for GitHub API
153
154 **How it's protected**:
155 1. Token stored in `.env` (gitignored)
156 2. Token loaded via `import.meta.env.GITHUB_TOKEN`
157 3. Token used only in server-side API routes
158 4. Token never sent to client browser
159 5. Downloads proxied through server
160
161 **Verify security**:
162 ```bash
163 # Check token isn't in code
164 grep -r "ghp_[a-zA-Z0-9]\{36\}" . --exclude-dir=node_modules
165
166 # Check .env is gitignored
167 git ls-files | grep .env
168
169 # Both should return no results
170 ```
171
172 ## 🎓 Security Training
173
174 ### For New Team Members
175
176 1. **Read this guide completely**
177 2. **Never commit secrets** - use environment variables
178 3. **Check before pushing** - review your commits
179 4. **Report incidents immediately** - no blame, just fix
180 5. **Keep credentials secure** - use password managers
181
182 ### Code Review Checklist
183
184 When reviewing PRs, verify:
185 - [ ] No `.env` files added
186 - [ ] No hardcoded tokens/keys
187 - [ ] Secrets loaded from environment
188 - [ ] No tokens in console.log()
189 - [ ] Error messages don't leak secrets
190 - [ ] Documentation uses placeholders
191
192 ## 📊 Regular Security Audits
193
194 ### Weekly:
195 - [ ] Review recent commits for leaks
196 - [ ] Check GitHub security alerts
197 - [ ] Verify environment variables are set
198
199 ### Monthly:
200 - [ ] Audit all secret usage
201 - [ ] Review access permissions
202 - [ ] Check for unused tokens
203 - [ ] Update dependencies
204
205 ### Every 6 Months:
206 - [ ] Rotate all tokens/keys
207 - [ ] Review team access
208 - [ ] Update security procedures
209 - [ ] Security training refresh
210
211 ## 🔐 Token Management
212
213 ### GitHub Personal Access Tokens
214
215 **Create token**:
216 1. Go to https://github.com/settings/tokens
217 2. Click "Generate new token" → Fine-grained token
218 3. Name: "PepakBasaJawa Downloads - [Your Name]"
219 4. Expiration: 1 year
220 5. Repository access: Only `setoelkahfi/pepakbasajawa`
221 6. Permissions: Contents: Read-only
222 7. Generate and copy immediately
223
224 **Store token**:
225 ```bash
226 # Add to .env (never commit!)
227 echo "GITHUB_TOKEN=ghp_your_token" >> .env
228
229 # Or use password manager
230 # 1Password, LastPass, Bitwarden, etc.
231 ```
232
233 **Rotate token** (every 6 months):
234 1. Generate new token
235 2. Update `.env` locally
236 3. Test locally: `npm run test:releases`
237 4. Update production env vars
238 5. Test production
239 6. Revoke old token
240 7. Document rotation date
241
242 ## 🚨 Emergency Contacts
243
244 If you discover a security issue:
245
246 1. **For leaked credentials**:
247 - Revoke immediately
248 - Contact: [Team Lead]
249 - Document incident
250
251 2. **For vulnerabilities**:
252 - Email: info@pepakbasajawa.com
253 - Use GitHub Security Advisories (private)
254 - Don't publicly disclose until patched
255
256 3. **For production issues**:
257 - Contact DevOps team
258 - Check monitoring dashboards
259 - Follow incident response plan
260
261 ## 📚 Additional Resources
262
263 ### Internal Docs:
264 - `SECURITY_AUDIT.md` - Latest security audit results
265 - `DESKTOP_DOWNLOADS_SETUP.md` - Feature setup guide
266 - `.env.example` - Template for environment variables
267
268 ### External Resources:
269 - [GitHub Token Security](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure)
270 - [OWASP Secure Coding](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/)
271 - [Git Security Best Practices](https://github.com/git/git/blob/master/Documentation/technical/security.txt)
272
273 ## ✅ Security Certification
274
275 I, _________________, have read and understood this security guide.
276
277 I commit to:
278 - Never committing secrets to the repository
279 - Using environment variables for all sensitive data
280 - Reviewing my code before committing
281 - Reporting security incidents immediately
282 - Following security best practices
283
284 Signature: _________________
285 Date: _________________
286
287 ---
288
289 **Document Version**: 1.0.0
290 **Last Updated**: 2024
291 **Next Review**: Every 6 months
292
293 **Remember: This is a PUBLIC repository. When in doubt, DON'T commit it!** 🔒