CRITICAL: Rotate exposed google_api_key in markets repo

[don-petry]

Summary

Secret scanning detected an exposed google_api_key in petry-projects/markets (alert opened 2026-04-01). This key must be rotated immediately.

Findings

• Alert type: google_api_key
• Status: OPEN since 2026-04-01
• Repo: petry-projects/markets

Recommended Actions

1. Rotate the API key in Google Cloud Console immediately
2. Review the secret scanning alert in the markets security tab to identify the exact commit/file
3. If the key was committed to history, consider using git filter-repo or BFG to scrub it
4. Add the key pattern to .gitignore and use GitHub environment secrets instead
5. Close the secret scanning alert once remediated

Context

Identified during weekly org CI/Security survey on 2026-04-05.

[claude]

Claude finished @don-petry's task in 1m 47s —— View job • claude/issue-56-20260406-0127 • Create PR ➔

---

Security Remediation: Exposed Google API Key

• Gather context and understand the request
• Search codebase for exposed Google API key (not found in current working tree)
• Update .gitignore to prevent future accidental commits of secret files
• Document manual steps required (key rotation, git history scrubbing)

---

Findings

The Google API key is not present in the current working tree. Based on the stack (Firebase Auth, FCM, Firebase Realtime DB), the exposure almost certainly came from a google-services.json (Android) or GoogleService-Info.plist (iOS) file committed to git history at some point.

What was done

Updated .gitignore to exclude:

• google-services.json — Android Firebase config (contains google_api_key)
• GoogleService-Info.plist — iOS Firebase config
• .env / .env.* files — general secret protection
• Expo build dirs, node_modules/, OS files

Manual steps still required (cannot be automated)

These must be completed by a human:

1. Rotate the key NOW — Go to Google Cloud Console → Credentials, find the exposed key, and click "Regenerate" or delete and create a new one.

2. Review the secret scanning alert — Visit the markets security tab to identify the exact commit and file.

3. Scrub git history — If the key is in commit history, run:

   # Install: pip install git-filter-repo
   git filter-repo --path google-services.json --invert-paths
   git filter-repo --path GoogleService-Info.plist --invert-paths
   # Then force-push (requires branch protection bypass)
   git push origin --force --all

   Or use BFG Repo Cleaner as an alternative.

4. Distribute secrets via EAS Secrets — After rotation, store the new config files using eas secret:push or CI environment variables rather than committing them.

5. Close the secret scanning alert — Once the key is rotated and history is clean, close the alert in the security tab.

---

[don-petry]

All remediation steps complete:

1. ✅ Key rotated in Google Cloud Console (done by @don-petry)
2. ✅ Secret scanning alert chore: install BMAD method scaffolding #1 closed as revoked
3. ✅ .gitignore hardened with patterns for .env*, google-services.json, GoogleService-Info.plist, firebase-adminsdk*.json, *.pem, *.key, etc.
4. ✅ Git history scrubbed via git filter-repo --replace-text — the leaked key value AIzaSyCBcl67UrXDeGOfSSndcEmph02dwcS-9oI has been replaced with REDACTED_GOOGLE_API_KEY across all branches and force-pushed.

Note: All branches were rewritten. Anyone with an existing local clone will need to re-clone or run git fetch && git reset --hard origin/<branch>. Branch protection on main was temporarily relaxed for the force-push and has been restored to its prior state (enforce_admins=true, allow_force_pushes=false, required checks SonarCloud + claude-code / claude).