• .env files
• API keys or secrets
• Private keys or certificates
• Database passwords
• Any sensitive configuration

• .env.example files with placeholder values
• Documentation about required environment variables
• Security guidelines (like this file)

All examples in this repository require the following environment variables:

XERO_CLIENT_ID=your-xero-client-id-here
XERO_CLIENT_SECRET=your-xero-client-secret-here

Choose one of the following:

OpenAI (for OpenAI examples):

OPENAI_API_KEY=sk-your-openai-api-key-here

Google AI Studio (for Google ADK examples):

GOOGLE_API_KEY=your-google-ai-studio-api-key-here

Google Vertex AI (alternative for Google ADK):

GOOGLE_CLOUD_PROJECT=your-project-id
GOOGLE_CLOUD_LOCATION=us-central1
GOOGLE_GENAI_USE_VERTEXAI=TRUE

1. Copy .env.example to .env in each project directory
2. Fill in your actual credentials in .env
3. Never commit .env files to version control

• Rotate API keys regularly (every 3-6 months)
• Immediately rotate if you suspect exposure
• Use different keys for development vs production

• Always check git status before committing
• Use git diff --cached to review staged changes
• Consider using git hooks to prevent credential commits

# ✅ GOOD: Copy example and fill with real values
cp .env.example .env
# Edit .env with your credentials

# ✅ GOOD: Check what you're committing
git status
git diff --cached

# ❌ BAD: Never do this
git add .env

1. Go to Xero Developer Portal
2. Create a new app or use existing one
3. Get your Client ID and Client Secret
4. Configure redirect URI if needed

1. Go to OpenAI Platform
2. Navigate to API Keys section
3. Create a new secret key
4. Copy and store securely

1. Go to Google AI Studio
2. Create a new API key
3. Copy and store securely

1. Revoke the exposed credentials immediately

   • Xero: Regenerate Client Secret in developer portal
   • OpenAI: Delete the exposed API key, create new one
   • Google: Disable the exposed key, create new one

2. Remove from public repositories

   • Delete the repository if possible
   • Use git history rewriting tools (BFG Repo-Cleaner)
   • Contact platform support for cache removal

3. Monitor for abuse

   • Check usage logs for unauthorized activity
   • Monitor billing for unexpected charges
   • Review access logs

• Use this SECURITY.md as a checklist
• Set up git hooks to prevent credential commits
• Use environment variable managers
• Regular security audits of repositories

Before pushing to any repository:

• No .env files are being committed
• All .env.example files have placeholder values only
• No hardcoded API keys in source code
• No private keys or certificates included
• .gitignore properly excludes sensitive files
• README includes security setup instructions

Remember: It's easier to prevent credential exposure than to clean it up afterward!