Summary

Reviews and hardens how Task-Bounty manages environment variables so secrets are not committed, leaked to the browser, or left in example templates.

The active app is Stellar/Soroban + Next.js. Configuration previously lived as hardcoded Horizon/network values, with a legacy EVM .env.example that looked like it expected real private keys and API slots. This PR adds safe templates, clearer gitignore rules, public-only env wiring with defaults, and documentation that spells out what must never be committed.

Acceptance criteria

• .env.example updated
• Sensitive values removed
• Documentation added

What changed

Env templates

• Added frontend/.env.example for the active Next.js app (public config only)
• Added root .env.example pointing contributors at the correct workspace files
• Updated legacy Documents/Task Bounty/.env.example:
  • Marked as reference-only (not used by the live frontend)
  • Removed filled-looking Alchemy URL/API slots
  • Left PRIVATE_KEY / API key fields empty

Secret exposure controls

• Frontend/root/docs/contract gitignores now:
  • ignore .env, .env.*, .env.local
  • allow committing .env.example via !.env.example
• Documented that NEXT_PUBLIC_* values are browser-visible and must never hold secrets

Runtime config (behavior preserved)

• Added frontend/src/lib/env.ts with getPublicEnv():
  • NEXT_PUBLIC_STELLAR_NETWORK (default PUBLIC)
  • NEXT_PUBLIC_HORIZON_URL (default https://horizon.stellar.org)
  • optional NEXT_PUBLIC_SOROBAN_RPC_URL / NEXT_PUBLIC_CONTRACT_ID
• Wired:
  • frontend/src/lib/stellar.ts → Horizon URL from env
  • frontend/src/hooks/stellar-wallets-kit.ts → network from env
• App still boots with no .env.local required

Documentation

• Added ENVIRONMENT.md — rules, variable table, local setup, deploy-secret guidance
• Updated SECURITY.md, SETUP.md, and frontend/README.md

Tests

• Added frontend/src/lib/env.test.ts:
  • default public config
  • secret-shape detection helper
  • asserts committed .env.example files have no sensitive-looking assignments

Security notes

Test plan

• cd frontend && pnpm test — 45 passed (includes env template checks)
• cd frontend && pnpm build — succeeds without .env.local
• cd frontend && pnpm lint — 0 errors
• git check-ignore -q frontend/.env.local — ignored
• git check-ignore -q frontend/.env.example — not ignored (trackable)
• Confirm GitHub Frontend CI passes on this PR
• Spot-check that no real credentials appear in the diff

Follow-ups (out of scope)

• Move deployer/CI secrets into GitHub Actions secrets / a vault
• Add server-only secrets when authenticated backend services are introduced

closes #36