All default credentials are removed from infrastructure components

PCI-DSS 4.0 Req 2.1 requires that all default passwords and unnecessary default accounts are removed before system components enter production. Req 8.3 mandates strong authentication for all users. Hardcoded credentials — postgres:postgres in a Dockerfile, sk_live_ keys in a .env committed to git — are the lowest-effort, highest-yield targets for attackers. CWE-798 (Use of Hard-coded Credentials) and CWE-1188 (Initialization with Default Value) are both directly exploitable. OWASP A05 (Security Misconfiguration) rates this category as endemic. A leaked Stripe live key means unauthorized charges or refunds; a leaked DB admin password means direct CDE access.

Replace every hardcoded value with an environment variable reference and add those variable names to .gitignore-protected .env.local. Use a secrets manager (AWS Secrets Manager, Supabase Vault) in production — no secret should exist anywhere in the codebase, even in git history.

# Before (fails Req 2.1)
ENV POSTGRES_PASSWORD=postgres

# After
ENV POSTGRES_PASSWORD=${DB_PASSWORD}

For Terraform, use var.db_password sourced from a tfvars file that is git-ignored, or use aws_secretsmanager_secret_version as the password source. Audit git history with git log -S 'sk_live_' to confirm secrets were never committed.