security: remove exposed credentials from .env.example and strip token logging

- Replace real Supabase keys, GitHub OAuth credentials in .env.example
  with placeholder values (real keys were committed and are in git history)
- Remove all console.log(token) calls from daily-note route that were
  leaking JWT tokens (containing GitHub access tokens) to server logs
- Fix daily-note route: return generic error instead of raw DB error
  message to avoid leaking internal schema details to clients
- Fix unauthorized response code: 400 → 401

Author: Priyanshu-byte-coder

.env.example

@@ -1,13 +1,13 @@
 # -------------------------------------------------------
 # Supabase
 # Project Settings → API → Project URL
-NEXT_PUBLIC_SUPABASE_URL=https://supabase.com/dashboard/project/dxvccvuzcvpisjytnrqc
+NEXT_PUBLIC_SUPABASE_URL=https://<project-ref>.supabase.co
 
 # Project Settings → API → anon / public key
-NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImR4dmNjdnV6Y3ZwaXNqeXRucnFjIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODAxNTA1NTQsImV4cCI6MjA5NTcyNjU1NH0.i6KJ7SBLQ5LpsN-d8q3-O0sMJbSIFVy2JNzm1kr41lg
+NEXT_PUBLIC_SUPABASE_ANON_KEY=your_supabase_anon_key
 
 # Project Settings → API → service_role secret (server-side only — never expose client-side)
-SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImR4dmNjdnV6Y3ZwaXNqeXRucnFjIiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImlhdCI6MTc4MDE1MDU1NCwiZXhwIjoyMDk1NzI2NTU0fQ.gip54uSJ1K63zTek58je6BKl0wRt7TC6IoAt33rsOF4
+SUPABASE_SERVICE_ROLE_KEY=your_supabase_service_role_key
 
 # -------------------------------------------------------
 # NextAuth
@@ -28,10 +28,10 @@ NEXTAUTH_SECRET=your_nextauth_secret
 # -------------------------------------------------------
 # GitHub OAuth App
 # github.com/settings/applications/new → Client ID
-GITHUB_ID=Ov23litbr03dy9vWnQSh
+GITHUB_ID=your_github_oauth_client_id
 
 # github.com/settings/applications/new → Client Secret
-GITHUB_SECRET=bdfa094aa67c8b619044bc36dafce3ffe40ec458
+GITHUB_SECRET=your_github_oauth_client_secret
 
 # -------------------------------------------------------
 # GitHub Webhook (optional — enables real-time metric refresh on push)
@@ -66,7 +66,7 @@ UPSTASH_REDIS_REST_TOKEN=your_upstash_redis_rest_token
 # Groq API Key (optional — enables AI-generated weekly summaries in the
 # AI Mentor widget using Llama-3).
 # console.groq.com → API Keys
-GROQ_API_KEY=gsk_...
+GROQ_API_KEY=your_groq_api_key
 
 # -------------------------------------------------------
 # Leaderboard Configuration
@@ -75,4 +75,3 @@ GROQ_API_KEY=gsk_...
 # Higher values = faster builds but more resource usage
 # WARNING: Do not exceed 100 without load testing — risks memory exhaustion
 LEADERBOARD_USER_CONCURRENCY=5
-

src/app/api/daily-note/route.ts

@@ -1,121 +1,90 @@
-import { NextResponse ,NextRequest} from "next/server";
+import { NextResponse, NextRequest } from "next/server";
 import { supabaseAdmin } from "@/lib/supabase";
 import { getToken } from "next-auth/jwt";
 
-export async function GET(req: NextRequest){
-
-  try{
+export async function GET(req: NextRequest) {
+  try {
     const token = await getToken({
       req,
       secret: process.env.NEXTAUTH_SECRET,
     });
-    console.log(token)
-  
+
     const userId = token?.githubId;
 
-    if(!userId){
-      return NextResponse.json(
-        {error: `Unauthorized`},
-        {status: 400}
-      );
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
 
     const today = new Date();
     const todayDate = today.toISOString().split("T")[0];
 
     const yesterday = new Date();
-    yesterday.setDate(yesterday.getDate() -1);
-
+    yesterday.setDate(yesterday.getDate() - 1);
     const yesterdayDate = yesterday.toISOString().split("T")[0];
 
-    const {data : todayData} = await supabaseAdmin
-    .from("daily_notes")
-    .select("*")
-    .eq("user_id",userId)
-    .eq("date",todayDate)
-    .single();
-
-    const {data : yesterdayData} = await supabaseAdmin
-    .from("daily_notes")
-    .select("*")
-    .eq("user_id",userId)
-    .eq("date",yesterdayDate)
-    .single();
-    console.log(todayData,yesterdayData);
+    const { data: todayData } = await supabaseAdmin
+      .from("daily_notes")
+      .select("*")
+      .eq("user_id", userId)
+      .eq("date", todayDate)
+      .single();
+
+    const { data: yesterdayData } = await supabaseAdmin
+      .from("daily_notes")
+      .select("*")
+      .eq("user_id", userId)
+      .eq("date", yesterdayDate)
+      .single();
+
     return NextResponse.json({
       todayNote: todayData?.note || "",
       yesterdayNote: yesterdayData?.note || "",
     });
-
-  }catch(error){
-    return NextResponse.json(
-      {error: `Something went wrong `},
-    {status: 500}
-    );
-    
+  } catch {
+    return NextResponse.json({ error: "Something went wrong" }, { status: 500 });
   }
 }
 
 export async function POST(req: NextRequest) {
- try{
-
-  const token = await getToken({
-    req,
-    secret: process.env.NEXTAUTH_SECRET,
-  });
-  console.log(token)
-
-  const userId = token?.githubId;
-  const body = await req.json();
-  console.log(body);
-  const { note} = body;
-  if(!userId){
-    console.log("no user id");
-    return NextResponse.json(
-      {error: "User id is requied "},
-      {status: 400}
-    );
-  }
-  if(!note || !note.trim()){
-    console.log("no note ");
-    return NextResponse.json(
-      {error: "Note cannot be empty"},
-      {status: 400}
-    );
-  }
-  if(note.length >280){
-    console.log("max len ");
-    return NextResponse.json(
-      {error: "Maximum 280 characters allowed"},
-      {status: 400}
-    );
-  }
-  const today = new Date().toISOString().split("T")[0];
-  const {data, error} = await supabaseAdmin
-  .from("daily_notes")
-  .upsert({
-    user_id: userId,
-    date: today,
-    note: note.trim(),
-  },{
-    onConflict:"user_id,date"
-  })
-  .select()
-  .single();
-  if(error){
-    console.log(error.message);
-    return NextResponse.json(
-      {error: error.message},
-      {status:500}
-    );
+  try {
+    const token = await getToken({
+      req,
+      secret: process.env.NEXTAUTH_SECRET,
+    });
+
+    const userId = token?.githubId;
+
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const body = await req.json();
+    const { note } = body;
+
+    if (!note || !note.trim()) {
+      return NextResponse.json({ error: "Note cannot be empty" }, { status: 400 });
+    }
+
+    if (note.length > 280) {
+      return NextResponse.json({ error: "Maximum 280 characters allowed" }, { status: 400 });
+    }
+
+    const today = new Date().toISOString().split("T")[0];
+    const { data, error } = await supabaseAdmin
+      .from("daily_notes")
+      .upsert(
+        { user_id: userId, date: today, note: note.trim() },
+        { onConflict: "user_id,date" }
+      )
+      .select()
+      .single();
+
+    if (error) {
+      return NextResponse.json({ error: "Failed to save note" }, { status: 500 });
+    }
+
+    return NextResponse.json(data);
+  } catch {
+    return NextResponse.json({ error: "Something went wrong" }, { status: 500 });
   }
-   console.log(data);
-  return NextResponse.json(data);
- }catch(error){
-  console.log(error);
-  return NextResponse.json(
-    {error: "Something went wrong"},
-    {status:500}
-  );
- }
-}
+}