Security: Remove committed .env.production files and harden .gitignore

[Copilot]

.env.production files containing credentials were committed to version control and not covered by .gitignore, exposing API keys and configuration to the public repo.

Changes

• .gitignore: Replaced narrow env-file rules with a broad .env.* exclusion, with an explicit negation to keep *.example files committable:

  .env.*
  !.env.*.example
  !.env.example

• git rm --cached: Untracks .env.production and apps/dashboard/.env.production — files are deleted from the repo but remain on disk locally.
• Example templates added: .env.production.example and apps/dashboard/.env.production.example committed as safe replacements, documenting all required variables with descriptive placeholders.

Required follow-up (repo owner)

• Revoke and rotate any API keys (GOOGLE_API_KEY, FCM_KEY) that were ever present in those files.
• Purge git history using git-filter-repo or BFG Repo-Cleaner — removing files from HEAD does not expunge them from history.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Security: Exposed credentials detected in this repository</issue_title>
<issue_description>## Leaked Credentials Detected

Hi there! While reviewing public repositories submitted to the Gemini Live Agent Challenge, we ran an automated security scan and found exposed credentials in this repo.

This repository contains .env files with what appear to be real credentials committed to version control. These files are typically meant to be kept out of source control via .gitignore.

What was found

Committed .env files:

• .env.production
• apps/dashboard/.env.production

Recommended actions

1. Revoke and rotate all exposed credentials immediately
   • For Google/GCP API keys: Google Cloud Console → APIs & Services → Credentials
   • For other services: check the respective provider's dashboard
2. Remove secrets from code — use environment variables or a secrets manager instead
3. Add .env to .gitignore to prevent future commits of secret files
4. Scrub git history — even after deleting the file, secrets remain in git history. Use git-filter-repo or BFG Repo-Cleaner to remove them
5. Consider using Google Secret Manager for production deployments

About this scan

This issue was created as part of a responsible disclosure effort after scanning public hackathon submissions. No credentials were used or exploited — only a read-only API endpoint was called to check if keys were active. The actual secret values are not included in this issue.

If you believe this is a false positive, feel free to close this issue.
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Security: Exposed credentials detected in this repository #31

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.