• ❌ .env files with real credentials
• ❌ Private keys (.pem, .key, .crt)
• ❌ Database passwords
• ❌ API keys or tokens
• ❌ SSL certificates

• ✅ Environment variables for secrets
• ✅ .gitignore for sensitive files
• ✅ env.sample as template (with fake data)
• ✅ Secrets managers in production (AWS Secrets Manager, HashiCorp Vault)

• Development: Any password (auto-generated recommended)
• Staging: Strong password (16+ chars, mixed case, numbers, symbols)
• Production:
  • Minimum 32 characters
  • Generated by password manager
  • Rotated regularly
  • Never reused

• Local Dev: sslmode=disable (acceptable)
• Staging: sslmode=require (mandatory)
• Production: sslmode=verify-full (mandatory)

• POSTGRES_PASSWORD must be set via environment
• Running without it will fail with clear error message
• Use: POSTGRES_PASSWORD=yourpassword docker-compose up -d

• ✅ Non-root user in Docker (nonroot:nonroot)
• ✅ Input validation at domain layer
• ✅ SQL injection protection (parameterized queries)
• ✅ Error handling (no sensitive data in responses)
• ⚠️ TODO: Add rate limiting
• ⚠️ TODO: Add authentication/authorization
• ⚠️ TODO: Add request logging

1. Immediately rotate all passwords
2. Revoke compromised API keys
3. Review git history: git log --all -- .env
4. Use BFG Repo-Cleaner if needed
5. Force push cleaned history
6. Notify team members

Before deploying:

• POSTGRES_PASSWORD is set (not using default)
• DATABASE_URL uses SSL (sslmode=require)
• All .env* files are in .gitignore
• No hardcoded credentials in code
• Secrets are stored in secrets manager
• Passwords are strong and unique

# Check for committed secrets
git log --all -- .env .env.* *.pem *.key

# Scan for hardcoded secrets (install gitleaks first)
gitleaks detect --source . --verbose

# Check dependencies for vulnerabilities
go list -json -m all | nancy sleuth

If you discover a security vulnerability:

1. DO NOT open a public GitHub issue
2. Email: security@yourcompany.com
3. Include: description, steps to reproduce, impact
4. Allow time for fix before public disclosure

1. Application Layer: Input validation, business rules
2. Transport Layer: HTTPS/TLS, no sensitive data in URLs
3. Database Layer: Encrypted connections, least privilege
4. Infrastructure: Firewall rules, VPC, security groups
5. Secrets Management: External secrets manager

Last Updated: 2026-01-10
Security Contact: TBD