CRITICAL: .env.local committed with live Clerk API keys #2

New issue

Closed

opened 2026-05-09 00:26:04 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 00:26:04 +00:00

Owner

Severity: Critical

The .env.local file containing live Clerk credentials is committed to the repository. Although .gitignore lists .env.local, it was apparently committed before the gitignore rule took effect.

Exposed secrets:

NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY — pk_test_...
CLERK_SECRET_KEY — sk_tes... (truncated in local copy but live key was in history)
DATABASE_URL — connection string

Risk: The Clerk secret key allows administrative access to user management including user creation, deletion, and org changes.

Fix:

Immediately rotate the exposed Clerk keys in the Clerk dashboard
Remove file from git tracking: git rm --cached .env.local
Purge from git history using git filter-branch or BFG Repo-Cleaner
Verify no other .env files are tracked

## Severity: Critical The `.env.local` file containing live Clerk credentials is committed to the repository. Although `.gitignore` lists `.env.local`, it was apparently committed before the gitignore rule took effect. **Exposed secrets:** - `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` — `pk_test_...` - `CLERK_SECRET_KEY` — `sk_tes...` (truncated in local copy but live key was in history) - `DATABASE_URL` — connection string **Risk:** The Clerk secret key allows administrative access to user management including user creation, deletion, and org changes. **Fix:** 1. Immediately rotate the exposed Clerk keys in the Clerk dashboard 2. Remove file from git tracking: `git rm --cached .env.local` 3. Purge from git history using `git filter-branch` or BFG Repo-Cleaner 4. Verify no other .env files are tracked