security: remove exposed credentials and patch dependencies

[kingxiaozhe]

Summary

• remove hard-coded DeepSeek/SiliconFlow credentials from the API route and Vercel config
• stop exposing ARK_API_KEY through Next.js client environment injection
• remove tracked editor-history snapshots and ignore future .history/ output
• add fail-closed environment handling, .env.example, and security guidance
• update Next.js and vulnerable transitive dependencies; production audit now reports zero known vulnerabilities
• restore strict production type checking, fix the resulting Next.js 15 route/layout issues, and add CI

Verification

• corepack pnpm@8.15.6 install --frozen-lockfile
• corepack pnpm@8.15.6 audit --prod — zero known vulnerabilities
• corepack pnpm@8.15.6 exec tsc --noEmit
• production next build with placeholder server credentials
• Gitleaks current-tree scan — zero findings

Required owner action

Previously committed credentials must be revoked and replaced in the SiliconFlow/DeepSeek and Volcengine ARK provider consoles. This PR removes them from the current tree but intentionally does not rewrite Git history.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comic-generator	Ready	Preview, Comment	Jul 23, 2026 10:55am