mirror of
https://github.com/Heretek-AI/GDevelop-Heretek.git
synced 2026-10-12 02:02:42 +00:00
Claude
6088075274
The two Google API keys shipped in the source tree were publicly-leaked
upstream-owned secrets. They cannot be revoked from this fork; this change
replaces them with clearly-marked dummy placeholders that operators must
override via env vars at runtime.
- newIDE/app/src/Utils/GDevelopServices/ApiConfigs.js
GDevelopFirebaseConfig.apiKey now reads process.env.GD_FIREBASE_API_KEY
with a safe fallback placeholder.
- Extensions/Firebase/tests/FirebaseExtension.spec.js
Test firebaseConfig.apiKey now reads process.env.GD_TEST_FIREBASE_API_KEY.
- .gitignore: add .env / .env.* / secrets.json / credentials patterns.
- SECRETS.md + .env.example: document the required env vars.
- newIDE/app/src/Utils/GDevelopServices/ApiConfigs.spec.js (NEW):
regression tests that assert the apiKey is env-driven and never equals
either leaked value (verified via 8/6-char fingerprints so the full
secret never appears in this tree).
Verified:
newIDE/app: 132 suites, 1206 passed (was 131 / 1202), 1 skipped, 0 failed.
Lint clean on modified files.
No full leaked key strings in any tracked file.
11 lines
399 B
Bash
11 lines
399 B
Bash
# Copy this file to `.env.local` and fill in real values.
|
|
# See SECRETS.md at the repo root for context.
|
|
|
|
# Firebase Web API key for the gdevelop-services project.
|
|
# Owned by the upstream 4ian/GDevelop project.
|
|
GD_FIREBASE_API_KEY=
|
|
|
|
# Firebase Web API key for the gdtest-e11a5 *test* project, used by the
|
|
# Firebase extension end-to-end test in Extensions/Firebase/tests/.
|
|
GD_TEST_FIREBASE_API_KEY=
|