No hardcoded secrets in frontend code

A hardcoded secret in source code is immediately compromised the moment the repository is cloned, forked, or accidentally made public — and Git history preserves it even after deletion. NIST 800-53 rev5 IA-5 (Authenticator Management) prohibits embedding authenticators in code, and SC-28 requires protection of information at rest including stored credentials. CWE-798 covers this exact failure; OWASP A07 (Identification and Authentication Failures) lists hardcoded credentials as a primary cause of large-scale breaches. A single leaked Stripe live key or database password is sufficient to exfiltrate all user data or drain financial accounts.

Remove every literal secret from source files and replace with process.env references. Add .env.local to .gitignore before the first commit; use .env.example with placeholder values as the only committed env template.

// lib/db.ts — BEFORE (wrong)
const client = new Client({ password: 'hunter2' })

// lib/db.ts — AFTER (correct)
const client = new Client({ password: process.env.DB_PASSWORD })

For secrets already in Git history, rotate the credentials immediately — removing the commit does not protect any clone taken before the rewrite. Store live secrets in Vercel Environment Variables, AWS Secrets Manager, or HashiCorp Vault. Run npx secretlint or git-secrets in CI to block future commits.