Pre-launch checklist

Before inviting collaborators

Rotate leaked credentials

Sensitive credentials were committed to git history. Even though the repo is private, any collaborator with access can see the full history.

• Rotate Supabase database password (Frankfurt project pskrfpqylbqzkgwwdglg) — Dashboard → Project Settings → Database → Reset password
• Rotate Supabase database password (US East project lidpxsnkpsscdgfifrin) — same steps
• Regenerate Supabase anon key if needed
• Remove hardcoded credentials from shell scripts (packages/db-tools/scripts/db/push.sh, push-remote.sh) — use $DATABASE_URL env var instead
• Update Vercel env vars with the new passwords after rotation

GitHub repository settings

• Enable branch protection on main — require PRs, no direct pushes
• Require your approval before merging PRs
• Add collaborators with "Write" role, not "Admin"

Access control

• Never share .env files — use Vercel env vars UI to grant access
• Keep Supabase admin credentials to yourself
• Keep Vercel project admin to yourself

Before going public

• Rewrite git history to remove leaked credentials (use git filter-repo) — or start from a fresh repo
• Audit .gitignore — ensure .env, .env.local, .env.production are all ignored
• Enable GitHub secret scanning — Settings → Code security → Secret scanning
• Set up CI (optional) — run linting and type checks on PRs to catch issues before merge