This page explains the project's local .env behavior and how to handle environment files and secrets when developing OmniRoute.
The project may generate a local .env file during npm install / postinstall for developer convenience. This file is intended only for local development and testing and must never be committed to version control.
Key points:
- The repository's
.gitignorealready ignores.env*files (see the.gitignoreentry). Do not remove or alter that rule unless you deliberately intend to commit a specific example file and have a documented process for it. - If a real secret is accidentally committed to the repo, rotate/revoke the credential immediately and remove it from the repository history (for example, using
git filter-repoor an equivalent remediation workflow). Contact the security/contact owner if you need help. - For CI and production, use the CI secrets or a secrets manager (GitHub Actions Secrets, Azure Key Vault, HashiCorp Vault, etc.) rather than committing secrets to files.
- Keep
.envin your local workspace only. Use.env.example(already tracked) to document required variables and acceptable example values. - When running tests locally that require secret-like values, prefer synthetic placeholders or runtime-generated ephemeral keys rather than real credentials.
- Add a short comment in tests that use placeholders so reviewers understand the fixture is synthetic.
- Some compiled or binary assets (e.g., embedded base64 WASM blobs) can contain ASCII substrings that look like credentials and may trigger text-based secret scanners. If these assets are legitimate, either mark them in the scanner's allowlist or exclude the directories in the scanner config.
- Rotate/revoke the key immediately.
- Remove the secret from the history and force-push a cleaned branch if necessary.
- Notify maintainers and follow your org's incident response checklist.