docs/SECURITY_ADVISORY.md

# Security Advisory

## Managing Hardcoded Secrets in GitHub

Your repository previously had GitHub code scanning alerts (the "eyes") because it detected sensitive keys in your code history. Even if you remove the keys from your current codebase, they remain in your Git history and are technically compromised.

### The Leaked Keys
1. **Google API Key (Gemini)**: Detected in `Frontend/simple_discover.js`
2. **Supabase Service Key**: Detected in `supabase/migrations/20260330231302_webhook-trigger.sql`
3. **GitHub PAT**: Pasted during testing.

### Immediate Action Required

To ensure your application is secure for enterprise use, you **must** rotate these keys.

1. **Rotate Supabase Key**:
   - Go to your Supabase Project Settings > API.
   - Click "Roll" next to the `service_role` secret.
   - Update your server environment variables with the new key.

2. **Rotate Google API Key**:
   - Go to Google Cloud Console > APIs & Services > Credentials.
   - Delete the exposed `AIza` key.
   - Generate a new key and update your environment variables.

3. **Rotate GitHub PAT**:
   - Go to GitHub > Settings > Developer Settings > Personal access tokens.
   - Revoke the token starting with `github_pat_...`
   - Generate a new one if needed for the Actions workflow and update the secret via `gh secret set GH_MODELS_TOKEN`.

### Resolving the Alerts on GitHub
Once the keys are rotated, you can safely go to the "Security" tab on your GitHub repository, view the "Secret scanning alerts", and dismiss them as "Revoked". This will hide the alerts while maintaining actual security.