Secrets Management

project/
├── .env              # Local secrets (git-ignored)
├── .env.example      # Template (committed)
└── .gitignore        # Must include .env

# API Keys
ANTHROPIC_API_KEY=your-key-here
OPENAI_API_KEY=your-key-here

# Service Credentials
DATABASE_URL=postgres://user:pass@host:5432/db
REDIS_URL=redis://localhost:6379

# Feature Flags
DEBUG=false
LOG_LEVEL=info

# In shell
source .env

# Or use dotenv in code
npm install dotenv

// index.js
require('dotenv').config();
const apiKey = process.env.ANTHROPIC_API_KEY;

# Secrets
.env
.env.local
.env.*.local
*.pem
*.key
credentials.json
secrets/

# IDE
.idea/
.vscode/settings.json

# OS
.DS_Store
Thumbs.db

#!/bin/sh
# .git/hooks/pre-commit

# Check for potential secrets
if git diff --cached --name-only | xargs grep -l -E "(API_KEY|SECRET|PASSWORD|TOKEN)=.+" 2>/dev/null; then
  echo "ERROR: Potential secrets detected in staged files"
  exit 1
fi

# Create secret
gcloud secrets create my-api-key --data-file=./secret.txt

# Access in code
gcloud secrets versions access latest --secret=my-api-key

# Use in Cloud Run
gcloud run services update my-service \
  --set-secrets=API_KEY=my-api-key:latest

production/
├── secrets/           # Stored in cloud secret manager
└── .env.production    # Non-sensitive config

development/
├── .env.local         # Local development secrets
└── .env.development   # Non-sensitive config

agents-squads/
├── hq/
│   └── .env          # All secrets here
├── engineering/
│   └── (references hq/.env)
└── website/
    └── (references hq/.env)

# Agent: Deploy Service

## Prerequisites
- GOOGLE_CLOUD_PROJECT set in environment
- ANTHROPIC_API_KEY available

## Instructions
1. Load environment: `source ../hq/.env`
2. Run deployment: `gcloud run deploy ...`

{
  "mcpServers": {
    "supabase": {
      "command": "npx",
      "args": ["-y", "@supabase/mcp-server"],
      "env": {
        "SUPABASE_ACCESS_TOKEN": "${SUPABASE_ACCESS_TOKEN}"
      }
    }
  }
}

# Remove from history (requires force push)
git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch .env" \
  --prune-empty --tag-name-filter cat -- --all