Skip to content

deployment #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
benhalverson merged 1 commit into from
Dec 10, 2025
Merged

deployment #29

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .env.production
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
VITE_BASE_URL=https://api.benhalverson.dev
VITE_DOMAIN=https://rc-store.benhalverson.dev
VITE_DOMAIN=https://rc-store.benhalverson.dev
VITE_STRIPE_PUBLISHABLE_KEY=pk_test_51RUggnFtN1eiSjAecw8NdboDU4D9MjxRBIlKSQj2y78HuLDK7z1h26EfEp7RUpro2jdYvW9Uzu4FA6SHoiVOEg0o00rPmfffwj
Comment on lines +2 to +3
Copy link

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Stripe publishable key should not be committed directly to version control, even in .env.production. According to the .gitignore, environment files like .env and .env.local are excluded, but .env.production is not.

Best practice is to inject this value via CI/CD environment variables or secrets management (e.g., GitHub Secrets, Cloudflare environment variables) rather than hardcoding it in version-controlled files. This prevents accidental exposure and allows different keys per deployment environment.

Suggested change
VITE_DOMAIN=https://rc-store.benhalverson.dev
VITE_STRIPE_PUBLISHABLE_KEY=pk_test_51RUggnFtN1eiSjAecw8NdboDU4D9MjxRBIlKSQj2y78HuLDK7z1h26EfEp7RUpro2jdYvW9Uzu4FA6SHoiVOEg0o00rPmfffwj
VITE_DOMAIN=https://rc-store.benhalverson.dev

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A Stripe test key (indicated by the pk_test_ prefix) is being added to a production environment file. Production environments should use live Stripe keys (prefixed with pk_live_), not test keys. Test keys will not process real payments and could cause issues in production.

Replace this with a production-ready Stripe publishable key or use environment-specific configuration via CI/CD secrets.

Suggested change
VITE_STRIPE_PUBLISHABLE_KEY=pk_test_51RUggnFtN1eiSjAecw8NdboDU4D9MjxRBIlKSQj2y78HuLDK7z1h26EfEp7RUpro2jdYvW9Uzu4FA6SHoiVOEg0o00rPmfffwj
VITE_STRIPE_PUBLISHABLE_KEY=pk_live_REPLACE_WITH_YOUR_LIVE_KEY

Copilot uses AI. Check for mistakes.