tiennm99 eeda68c34a chore(ci): add NEXT_PUBLIC_*=sb_secret_* leak guard ...

Defense-in-depth check that fails the build (and the local pre-push
workflow) if a server secret value is assigned to a NEXT_PUBLIC_*
variable — those get bundled into the browser by Next.js.

- scripts/check-no-secret-leak.mjs: git grep for the assignment shape,
  excluding lockfiles and the script itself
- package.json: pnpm check:no-secret-leak
- .github/workflows/ci.yml: run the guard right after install, before
  format/lint/typecheck/build
- docs/threat-model.md: close the last Unresolved item

2026-05-25 16:19:43 +07:00

..

runbooks

docs(infra): add shared-supabase config, restore runbook, threat model, db preflight

2026-05-25 15:57:10 +07:00

supabase-shared-config.md

docs: record phase-5/7 + key-rotation decisions

2026-05-25 16:16:38 +07:00

threat-model.md

chore(ci): add NEXT_PUBLIC_*=sb_secret_* leak guard

2026-05-25 16:19:43 +07:00