mirror of
https://github.com/Sea-Haven-Industries/shoc-backend.git
synced 2026-10-01 15:43:14 +00:00
Adam Moussa
c887d6d9d8
Replace all hardcoded credentials with configuration-injected values:
- SQL Server connection strings -> ${CONNECTION_STRING} env-var placeholders (4 appsettings files)
- SendGrid API keys -> ${SENDGRID_API_KEY} (incl. commented copies in SendMessage.cs)
- JWT signing secret -> ${JWT_SECRET} (3 appsettings files)
- AWS access key pair in UploadFileHp.cs -> DI-injected IAmazonS3 (SDK default credential chain)
- Google Maps API keys in App.razor / Home.razor -> IConfiguration lookup
- Legacy SMTP credentials in SendMessage.cs comments -> placeholders
Add .env.example documenting required environment variables and a
Configuration & Secrets section in BACKEND_ARCHITECTURE.md.
All exposed credentials were rotated 2026-06-05 prior to this scrub.
Source: github-audit-report.md Criticals 1-2 (Agent A4).
Verified: dotnet build 0 errors; secret-pattern grep clean.
26 lines
1.1 KiB
JSON
26 lines
1.1 KiB
JSON
{
|
|
"ConnectionStrings": {
|
|
//"DefaultConnection": "Server=.;Database=SeahavenIndustries;TrustServerCertificate=True;Trusted_Connection=True;MultipleActiveResultSets=true",
|
|
//"DefaultConnection": "Server=.\\SqlExpress;Database=SeahavenIndustries;TrustServerCertificate=True;Trusted_Connection=True;MultipleActiveResultSets=true",
|
|
|
|
// Provide the real value via environment variable ConnectionStrings__DefaultConnection,
|
|
// user-secrets, or appsettings.Development.json (which is gitignored). Do NOT commit credentials.
|
|
"DefaultConnection": "${CONNECTION_STRING}",
|
|
"excelconnection": "Provider=Microsoft.ACE.OLEDB.12.0;Data Source={0};Extended Properties='Excel 8.0;HDR=YES'"
|
|
},
|
|
"Logging": {
|
|
"LogLevel": {
|
|
"Default": "Information",
|
|
"Microsoft.AspNetCore": "Warning"
|
|
}
|
|
},
|
|
"SendGrid": {
|
|
// Provide the real value via environment variable SendGrid__ApiKey or user-secrets.
|
|
"ApiKey": "${SENDGRID_API_KEY}"
|
|
},
|
|
"GoogleMaps": {
|
|
// Provide the real value via environment variable GoogleMaps__ApiKey or user-secrets.
|
|
"ApiKey": "${GOOGLE_MAPS_API_KEY}"
|
|
},
|
|
"AllowedHosts": "*"
|
|
}
|