[Copilot]

The issue was a secret-management risk: CLERK_SECRET_KEY appeared in a frontend .env.example, which can mislead deployments into storing backend secrets in a broader-visibility context. This change removes that unsafe pattern and clarifies backend-only placement.

• What changed

  • Frontend env template hardening
    • Updated apps/excelidraw-frontend/.env.example to remove CLERK_SECRET_KEY=....
    • Added an explicit note that CLERK_SECRET_KEY must be configured only in backend services (http-backend / ws-backend).

• Why this matters

  • Prevents accidental secret exposure
    • Avoids propagating backend secret configuration into frontend environment templates.

# Before
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
CLERK_SECRET_KEY=sk_test_...

# After
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
# Set CLERK_SECRET_KEY only in backend services (http-backend/ws-backend), not in frontend env.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
quick-draw-docs	Ready	Preview, Comment	Jul 13, 2026 5:13am
quick-draw-excelidraw-frontend	Ready	Preview, Comment	Jul 13, 2026 5:13am
quick-draw-excelidraw-frontend-6ntt	Ready	Preview, Comment	Jul 13, 2026 5:13am

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

This PR hardens secret management by removing CLERK_SECRET_KEY from the frontend environment template to reduce the risk of backend secrets being mistakenly configured (and potentially exposed) in a frontend context.

Changes:

• Removed CLERK_SECRET_KEY=... from apps/excelidraw-frontend/.env.example.
• Added an explicit inline note indicating CLERK_SECRET_KEY must be configured only in backend services (http-backend / ws-backend).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.