Skip to content

SECURITY-ROTATION.md

Latest commit

 

History

History
67 lines (47 loc) · 2.46 KB

SECURITY-ROTATION.md

File metadata and controls

67 lines (47 loc) · 2.46 KB
Raw

Credential Rotation Checklist

Why: The initial commit (.env.backup) exposed production secrets to git history. All credentials below should be rotated with their respective providers. Optionally scrub git history with git filter-repo or BFG Repo-Cleaner afterward.

MongoDB Atlas

  • MONGODB_URI — Atlas console → Database Access → Edit user → Change password
    • Update connection string in production .env
    • Verify app connects after rotation

Cloudinary

  • CLOUDINARY_CLOUD_NAME / API_KEY / API_SECRET — Cloudinary Console → Settings → Access Keys
    • Generate new API key pair
    • Revoke the old key pair after deploy

Google OAuth

  • GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET — Google Cloud Console → APIs & Services → Credentials
    • Create new OAuth 2.0 client or reset the secret
    • Update authorized redirect URIs if needed
    • Also rotate VITE_GOOGLE_CLIENT_ID on the frontend

Gemini AI

  • GEMINI_API_KEY — Google AI Studio → API Keys
    • Generate a new key, delete the old one

Upstash Redis

  • UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN — Upstash Console → Database → REST API
    • Reset the REST token (URL stays the same)

JWT Secrets

  • JWT_SECRET — Generate a new random value: 
    node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
  • JWT_REFRESH_SECRET — Same generation method

Email — Gmail (current)

  • EMAIL_USER / EMAIL_PASS — Google Account → Security → App Passwords
    • Generate a new app password, revoke the old one

Email — Custom Domain (studynest.dev, Phase 2)

When the custom domain email migration is complete (noreply@studynest.dev, support@studynest.dev, bugs@studynest.dev via Resend.com), add:

  • RESEND_API_KEY — Resend dashboard → API Keys → Create new key, revoke old one
    • Update EMAIL_PROVIDER=resend and RESEND_API_KEY in production .env
    • Verify DNS records (SPF, DKIM, DMARC) for studynest.dev are still valid after rotation

Post-Rotation

  • Deploy updated .env to all environments (Render.com backend + Vercel frontend)
  • Smoke-test: login, Google OAuth, file upload, meeting join, AI chat, email delivery
  • (Optional) Scrub git history to remove .env.backup: 
    # Using BFG Repo-Cleaner
bfg --delete-files .env.backup
git reflog expire --expire=now --all && git gc --prune=now --aggressive
git push --force