Skip to content

Security: jayshah2005/rhythm

Security

SECURITY.md

Security Checklist

✅ Pre-Commit Security Check

Before pushing to GitHub, ensure:

1. No API Keys in Code

# Check for hardcoded API keys
grep -r "AIzaSy\|arc_o15kGL" --exclude-dir=node_modules --exclude=".env" .
# Should return: "No API keys found in tracked files"

2. Environment File is Ignored

# Verify .env is ignored by git
git check-ignore .env
# Should return: ".env"

3. Only Placeholder Values in Code

  • ✅ config/env.js: Uses your_gemini_api_key_here and your_arcade_api_key_here
  • ✅ app.config.js: Uses process.env.GEMINI_API_KEY and process.env.ARCADE_API_KEY
  • ✅ config/env.example: Contains example placeholders

4. .gitignore is Complete

# Check .gitignore includes environment files
grep -E "\.env" .gitignore
# Should show: .env*.local, .env

There aren’t any published security advisories