.gitignore

@@ -26,3 +26,12 @@ dist-ssr
 *.sw?
 public/posts/*
 public/posts/index.json
+
+# Environment variables - never commit these!
+.env
+.env.local
+.env.production
+.env.*.local
+backend/.env
+backend/.env.production
+backend/.env.local

backend/.env

@@ -1 +0,0 @@
-GEMINI_API_KEY=AIzaSyBn_UbFZKCZ18GeMv6l0tSccxDpzRJsbW0

backend/.env.example

@@ -0,0 +1,4 @@
+# Local Development Environment Variables
+# Copy this file to .env and fill in your actual values
+
+GEMINI_API_KEY=your_gemini_api_key_here

backend/.env.production → backend/.env.production.example

@@ -1,20 +1,22 @@
 # Production Environment Variables
+# Copy this file to .env.production and fill in your actual values
 
 # Server Configuration
 NODE_ENV=production
 PORT=3001
 
 # Session Configuration - CHANGE THIS SECRET IN PRODUCTION!
-SESSION_SECRET=your-super-secret-session-key-change-this-immediately
+SESSION_SECRET=generate_a_secure_random_string_here
 
 # CORS Configuration - Update with your actual domain
-FRONTEND_URL=https://goonblog.thevakhovske.eu.org
+FRONTEND_URL=https://your-domain.com
 
 # Database/Storage paths (relative to backend directory)
 POSTS_DIR=../public/posts
 THEMES_FILE=./themes.json
 
-GEMINI_API_KEY=AIzaSyBn_UbFZKCZ18GeMv6l0tSccxDpzRJsbW0
+# AI Configuration
+GEMINI_API_KEY=your_gemini_api_key_here
 
 # Security Settings
 COOKIE_SECURE=true