From 2093898198a392ff29621dee242bc144003bedb5 Mon Sep 17 00:00:00 2001
From: saqib mir <saqibmit580@gmail.com>
Date: Fri, 21 Aug 2026 16:10:32 +0530
Subject: [PATCH] fix: stop tracking .env files with committed secrets

.env.development had a real Postgres/Redis password and JWT secret
committed in plain text; .env.test and .env.prod were tracked too.
Untrack all .env* files going forward and add .env.example as the
onboarding template instead.

Note: the exposed dev credentials are still in git history and must
be rotated separately.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .env.development | 21 ---------------------
 .env.example     | 29 +++++++++++++++++++++++++++++
 .env.prod        | 20 --------------------
 .env.test        | 20 --------------------
 .gitignore       |  5 +++++
 5 files changed, 34 insertions(+), 61 deletions(-)
 delete mode 100644 .env.development
 create mode 100644 .env.example
 delete mode 100644 .env.prod
 delete mode 100644 .env.test

diff --git a/.env.development b/.env.development
deleted file mode 100644
index 70dc5f6..0000000
--- a/.env.development
+++ /dev/null
@@ -1,21 +0,0 @@
-NODE_ENV=development
-PORT=4501
-
-# Nest build
-BUILD_COMMAND=npm run build:development
-
-# Database
-POSTGRES_HOST=postgres
-POSTGRES_DB=support_dev
-POSTGRES_USER=support_user
-POSTGRES_PASSWORD=z1F3tKF1JNDBQmMq95Up
-DATABASE_URL=postgresql://support_user:z1F3tKF1JNDBQmMq95Up@postgres:5432/support_dev
-
-# Redis
-REDIS_HOST=redis
-REDIS_PORT=6379
-REDIS_PASSWORD=D7FJ7QDKo5gF9KQAO1GL
-
-# Security & CORS
-JWT_SECRET=super-secret-development-jwt-key-32-chars-long
-CORS_ORIGINS=https://support-dev.maskantech.in
\ No newline at end of file
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..ef48693
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,29 @@
+NODE_ENV=development
+PORT=4501
+
+# Build
+BUILD_COMMAND=npm run build:development
+
+# Database
+POSTGRES_HOST=postgres
+POSTGRES_DB=support_dev
+POSTGRES_USER=support_user
+POSTGRES_PASSWORD=CHANGE_ME
+DATABASE_URL=postgresql://support_user:CHANGE_ME@postgres:5432/support_dev
+
+# Redis
+REDIS_HOST=redis
+REDIS_PORT=6379
+REDIS_PASSWORD=CHANGE_ME
+
+# Security & CORS
+JWT_SECRET=CHANGE_ME_32_CHAR_MINIMUM_SECRET
+JWT_ACCESS_EXPIRES=15m
+JWT_REFRESH_EXPIRES=7d
+CORS_ORIGINS=http://localhost:3000
+
+# AWS S3 / storage
+AWS_REGION=us-east-1
+AWS_S3_BUCKET=supporthub-attachments
+AWS_ACCESS_KEY_ID=CHANGE_ME
+AWS_SECRET_ACCESS_KEY=CHANGE_ME
diff --git a/.env.prod b/.env.prod
deleted file mode 100644
index cd7763c..0000000
--- a/.env.prod
+++ /dev/null
@@ -1,20 +0,0 @@
-NODE_ENV=production
-PORT=4503
-
-# Nest build
-BUILD_COMMAND=npm run build:prod
-
-# Database
-POSTGRES_HOST=postgres
-POSTGRES_DB=myapp_prod
-POSTGRES_USER=myapp_prod
-POSTGRES_PASSWORD=CHANGE_ME
-DATABASE_URL=postgresql://myapp_prod:CHANGE_ME@postgres:5432/myapp_prod
-
-REDIS_HOST=redis
-REDIS_PORT=6379
-REDIS_PASSWORD=CHANGE_ME
-
-# Security & CORS
-JWT_SECRET=CHANGE_ME_PRODUCTION_JWT_SECRET_32_CHARS
-CORS_ORIGINS=https://app.supporthub.com,https://admin.supporthub.com
\ No newline at end of file
diff --git a/.env.test b/.env.test
deleted file mode 100644
index 5eca7c6..0000000
--- a/.env.test
+++ /dev/null
@@ -1,20 +0,0 @@
-NODE_ENV=test
-PORT=4502
-
-# Nest build
-BUILD_COMMAND=npm run build:test
-
-# Database
-POSTGRES_HOST=postgres
-POSTGRES_DB=myapp_test
-POSTGRES_USER=myapp_test
-POSTGRES_PASSWORD=test_password
-DATABASE_URL=postgresql://myapp_test:test_password@postgres:5432/myapp_test
-
-REDIS_HOST=redis
-REDIS_PORT=6379
-REDIS_PASSWORD=test_redis_password
-
-# Security & CORS
-JWT_SECRET=super-secret-testing-jwt-key-32-chars-long
-CORS_ORIGINS=http://localhost:3000
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index cef77ef..395c6ce 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,8 @@ Thumbs.db
 docker/postgres/data/
 docker/redis/data/
 docker/minio/data/
+
+# Environment files (secrets) — never commit real credentials
+.env
+.env.*
+!.env.example