fix(security): clear vibecoder semgrep blockers

[Nadav011]

Summary

• replace semgrep-flagged dynamic console format strings with constant log messages and metadata objects
• replace the JWT-shaped Supabase anon example with a neutral placeholder in env.example
• keep runtime behavior intact while removing current-head Security Scan blockers

Verification

• npm run lint
• npm run typecheck
• EXPO_PUBLIC_SUPABASE_URL=https://placeholder.supabase.co EXPO_PUBLIC_SUPABASE_ANON_KEY=placeholder npm run build

Summary by CodeRabbit

• Chores
  • Updated example environment configuration with placeholder values for clearer setup guidance.
  • Improved error logging structure across store initialization, error handling, and storage operations for enhanced consistency and debugging.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f613c4d2-671c-4e27-bdf3-62d4242ff972

📥 Commits

Reviewing files that changed from the base of the PR and between cace2ff and a20ef04.

📒 Files selected for processing (4)

• app/_layout.tsx
• components/ui/SectionErrorBoundary.tsx
• env.example
• utils/storage.ts

---

📝 Walkthrough

Walkthrough

The changes convert error and warning logging across multiple files from formatted strings to structured logging format with message and payload objects, and update an example environment variable placeholder.

Changes

Cohort / File(s)	Summary
Structured Logging Updates app/_layout.tsx, components/ui/SectionErrorBoundary.tsx, utils/storage.ts	Replaced formatted console messages with structured logging: fixed message strings paired with objects containing context data (store name, section name, operation type, error details).
Environment Configuration env.example	Updated EXPO_PUBLIC_SUPABASE_ANON_KEY placeholder from a concrete JWT-like string to a descriptive placeholder text.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 Hopping through the logs with glee,
Structured messages now I see!
From strings to objects, neat and clear,
Better debugging, we cheer!
📋✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/semgrep-and-jwt

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR addresses Semgrep security-scan blockers by removing dynamic console format strings and sanitizing the example Supabase anon key in the environment template, aiming to keep runtime behavior unchanged while clearing CI security gates.

Changes:

• Replaced template-string console logs with constant messages plus structured metadata objects.
• Updated env.example to use a neutral placeholder for EXPO_PUBLIC_SUPABASE_ANON_KEY.
• Adjusted error logging in storage/error-boundary/store init paths to match the new logging pattern.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
utils/storage.ts	Converts storage error log to constant message + metadata object.
components/ui/SectionErrorBoundary.tsx	Converts section error boundary log to constant message + metadata object.
app/_layout.tsx	Converts store initialization warning to constant message + metadata object (dev-only).
env.example	Replaces JWT-shaped example anon key with a placeholder value.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

handleStorageError now logs only err.message inside an object. To make these errors actionable (and consistent with other error logs in the app), include the actual Error object (or at least stack) in the metadata so stack traces aren’t lost during debugging, while keeping the log message constant for semgrep.

Suggested change

	message: err.message,
	message: err.message,
	error: err,
	stack: err.stack,

[Copilot]

env.example now uses a placeholder anon key, but the Supabase URL is still a specific project URL. Since anon keys are project-specific, leaving a real URL here is misleading (copy/paste will fail unless the user also changes the URL) and may unintentionally point people at a real project. Consider replacing the URL with a neutral placeholder to match the key.

Suggested change

	EXPO_PUBLIC_SUPABASE_URL=https://shchfellocvnhrhhtiui.supabase.co
	EXPO_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co