[Security] Credentials were committed to this repository — rotation and history purge required

[ayaangazali]

A source scan of this repository found API credentials committed in real key format, present both in current files and in git history.

Deliberately not naming files, lines, commits or key prefixes here — this repo is public, and a public pointer to a live credential is worse than the leak itself. The precise inventory has been passed to the maintainers privately.

What is needed, in order

1. Rotate every affected credential first. History rewriting does not un-leak anything. Anyone who cloned or forked this repo already has the values, and public repos are continuously scraped. Assume compromised, not "possibly exposed".
2. Remove the values from the current tree, replacing them with os.getenv(...) / .env.example placeholders.
3. Purge history (git filter-repo, or GitHub Support for the cached views). Note this rewrites SHAs and breaks forks/clones — do it after rotation, not instead of it.
4. Audit for use. Check provider and platform dashboards for activity on the affected credentials from unrecognised sources, over the whole window they were public.

Preventing recurrence

• Enable GitHub Push Protection and secret scanning on this org — it blocks the commit at push time. This is the single highest-value change; the org currently has no secret-scanning alerts endpoint enabled.
• Add a pre-commit hook (gitleaks / detect-secrets) for local defence.
• Keep real keys out of tests entirely — tests that need a key should read it from the environment and skip when it is absent.

Scope note

The same scan flagged credentials in at least one other public repo in this org, so this is a pattern rather than a one-off. Worth a sweep across all public repos rather than a per-repo fix.