ESP API credentials stored in environment variables

A hardcoded SendGrid or Mailgun API key in a committed source file is a credential that any engineer with repository read access — and any attacker who gains access to the repo, a build artifact, or a public GitHub fork — can use immediately to send email at your expense, under your sending domain, to any recipient list. This maps to OWASP A02 (Cryptographic Failures) and CWE-798 (Use of Hard-coded Credentials). The damage is not theoretical: repositories are leaked, build logs are captured, and Docker image layers are extracted. Committing credentials is an irreversible exposure until the key is rotated.

Load all ESP credentials via process.env and fail loudly at startup if the variable is absent, in lib/esp-client.ts:

const apiKey = process.env.SENDGRID_API_KEY
if (!apiKey) {
  throw new Error('SENDGRID_API_KEY environment variable is required')
}
sgMail.setApiKey(apiKey)

Audit .env.example to confirm it contains only placeholder values like your-key-here. Rotate any key that has ever appeared in a committed file, even in a branch that was never merged.