Fix env validation

package.json

@@ -3,15 +3,16 @@
   "version": "0.2.0",
   "private": true,
   "scripts": {
-    "dev": "next dev",
-    "build": "next build && node scripts/copy-standalone-static.js",
-    "start": "next start",
-    "lint": "next lint",
-    "type-check": "tsc --noEmit",
-    "test": "vitest run",
-    "test:e2e": "playwright test",
-    "supabase:generate-types": "npx supabase@latest gen types typescript --local > src/types/supabase.ts"
-  },
+  "dev": "next dev",
+  "validate-env": "node scripts/validate-env.js",
+  "build": "npm run validate-env && next build && node scripts/copy-standalone-static.js",
+  "start": "next start",
+  "lint": "next lint",
+  "type-check": "tsc --noEmit",
+  "test": "vitest run",
+  "test:e2e": "playwright test",
+  "supabase:generate-types": "npx supabase@latest gen types typescript --local > src/types/supabase.ts"
+},
   "dependencies": {
     "@ducanh2912/next-pwa": "^10.2.9",
     "@supabase/ssr": "^0.10.3",

scripts/validate-env.js

@@ -0,0 +1,34 @@
+const sensitivePatterns = [
+  "private_key",
+  "secret",
+  "supabase_secret",
+  "github_token",
+  "token",
+  "password",
+  "api_key",
+  "apikey",
+];
+
+let hasErrors = false;
+
+console.log("🔍 Validating environment variables...");
+
+for (const key of Object.keys(process.env)) {
+  const lowerKey = key.toLowerCase();
+
+  const isSensitive = sensitivePatterns.some((pattern) =>
+    lowerKey.includes(pattern)
+  );
+
+  if (isSensitive && !key.startsWith("NEXT_PUBLIC_")) {
+    console.error(`❌ Sensitive environment variable detected: ${key}`);
+    hasErrors = true;
+  }
+}
+
+if (hasErrors) {
+  console.error("\n🚨 Build blocked: Private credentials detected.");
+  process.exit(1);
+}
+
+console.log("✅ Environment validation passed.");

src/components/ExportButton.tsx

@@ -709,10 +709,17 @@ export default function ExportButton() {
         aria-label="Export dashboard metrics as CSV"
         className="flex w-full items-center justify-center gap-2 rounded-lg border border-[var(--border)] bg-[var(--control)] px-4 py-2 text-sm font-medium text-[var(--card-foreground)] transition-all hover:border-[var(--accent)] disabled:opacity-50 sm:w-auto sm:min-w-[140px] hover:opacity-90 active:scale-95"
       >
-        <svg aria-hidden="true" className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-          <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4" />
-        </svg>
-        {isExportingCSV ? "Exporting..." : "Export CSV"}
+        {isExportingCSV ? (
+  <svg className="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+    <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4" />
+    <path className="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 22 6.477 22 12h-4z" />
+  </svg>
+) : (
+  <svg aria-hidden="true" className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+    <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4" />
+  </svg>
+)}
+{isExportingCSV ? "Exporting..." : "Export CSV"}
       </button>
 
       <button
@@ -723,10 +730,17 @@ export default function ExportButton() {
         className="flex min-w-0 flex-1 items-center justify-center gap-2 rounded-lg bg-[var(--accent)] px-4 py-2 text-sm font-medium text-[var(--accent-foreground)] transition-all hover:opacity-90 disabled:opacity-50 sm:min-w-[140px] sm:flex-none active:scale-95"
         suppressHydrationWarning
       >
-        <svg aria-hidden="true" className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-          <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 10v6m0 0l-3-3m3 3l3-3m2 8H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z" />
-        </svg>
-        {isExportingPDF ? "Exporting..." : "Export PDF"}
+        {isExportingPDF ? (
+  <svg className="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+    <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4" />
+    <path className="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 22 6.477 22 12h-4z" />
+  </svg>
+) : (
+  <svg aria-hidden="true" className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+    <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 10v6m0 0l-3-3m3 3l3-3m2 8H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z" />
+  </svg>
+)}
+{isExportingPDF ? "Exporting..." : "Export PDF"}
       </button>
 
       <button
@@ -737,10 +751,17 @@ export default function ExportButton() {
         className="flex min-w-0 flex-1 items-center justify-center gap-2 rounded-lg border border-[var(--border)] bg-[var(--control)] px-4 py-2 text-sm font-medium text-[var(--card-foreground)] transition-colors hover:border-[var(--accent)] disabled:opacity-50 sm:min-w-[140px] sm:flex-none"
         suppressHydrationWarning
       >
-        <svg aria-hidden="true" className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-          <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4" />
-        </svg>
-        {isExportingJSON ? "Exporting..." : "Export JSON"}
+        {isExportingJSON ? (
+  <svg className="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+    <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4" />
+    <path className="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 22 6.477 22 12h-4z" />
+  </svg>
+) : (
+  <svg aria-hidden="true" className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+    <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4" />
+  </svg>
+)}
+{isExportingJSON ? "Exporting..." : "Export JSON"}
       </button>
     </div>
   );