Summary

• Added .env.production file with clear warnings about security
• Updated documentation to clarify build-time vs runtime variables
• Added warnings to prevent accidental secret exposure in client bundle

Changes

New File: .env.production

• Added with production Turnstile site key
• Includes prominent warnings about not putting secrets here
• Explains that this file is for build-time PUBLIC variables only

Documentation Updates

docs/LOCAL_DEVELOPMENT.md:

• Added comprehensive explanation of all environment files
• Clear distinction between build-time and runtime variables
• Examples for each file type with warnings

docs/TURNSTILE_SETUP.md:

• Added section about .env.production for production builds
• Warning about not putting secrets in build-time files
• Clarified the difference between public and secret keys

README.md:

• Updated configuration section with environment variable explanation
• Added warning about .env files containing only public variables
• Clear examples of what goes where

Security Impact

This change helps prevent developers from accidentally exposing secrets by:

• Making it crystal clear which files are for public vs secret values
• Adding warnings in multiple places
• Providing the correct patterns for handling secrets

Test Plan

• Verified .env.production is properly formatted
• Documentation is clear and consistent
• Warnings are prominent and helpful
• Verify build process uses .env.production correctly
• Confirm no secrets are exposed in client bundle

🤖 Generated with Claude Code