chore: stop tracking .env (hygiene) - #112
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request removes the tracked .env file containing development configuration and secrets, and introduces a comprehensive ARCHITECTURE_REVIEW.md document. The new document provides a critical red-team architectural assessment of the self-correcting-executor repository, detailing core structural failures, non-functional self-correction mechanisms, missing backend endpoints, and recommending a complete clean rebuild. There are no review comments to address.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
.env was committed before .gitignore covered it. The committed values are development placeholders (e.g. DWAVE_API_TOKEN=development-mode, JWT_SECRET_KEY=dev-jwt-secret-key-...), not live credentials, so no rotation is required. Untracking it keeps real local values from being committed later; .gitignore already ignores .env. Local copy preserved. https://claude.ai/code/session_01AGrYSaaxGvpbp4Wzy3o2mi
fc089ec to
8dc4265
Compare
groupthinking
changed the title
2 participants
Stop tracking
.envFollow-up to the architecture review (#110), which flagged the committed
.env. The file was committed before.gitignorecovered it (.gitignorealready lists.envat lines 198/338/419), so the ignore rules never took effect.Correction from the original review
The review described this as a "live secret leak." On inspection of the actual values, they are development placeholders, not real credentials:
DWAVE_API_TOKENdevelopment-modeJWT_SECRET_KEYdev-jwt-secret-key-minimum-32-characters-longAPI_SECRET_KEYdev-api-secret-key-minimum-32-characters-longENCRYPTION_KEYdev-encryption-key-for-local-development-onlySo no credential rotation is required, and there is nothing sensitive to purge from git history.
Why still do this
Tracking
.envis an anti-pattern regardless of the current values: the next contributor who drops real secrets into their local.envwould commit them by default. This change removes.envfrom tracking (local working copy preserved);.gitignorekeeps it out going forward. Pure hygiene — scope is a single file, 29 deletions.https://claude.ai/code/session_01AGrYSaaxGvpbp4Wzy3o2mi