Fix security vulnerabilities and improve environment configuration

- Remove hardcoded SECRET_KEY from settings.py (now requires env var) - Remove hardcoded database credentials from PostgreSQL config - Add environment variable validation on Django startup - Fix Stripe API key logging to prevent credential exposure - Update .env.example to match Railway deployment structure - Replace exposed API key in documentation with placeholder - Maintain compatibility with existing Railway deployment setup 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-08-18 09:52:58 +00:00 · 2025-07-13 12:30:00 +05:30 · 2025-07-13 12:30:00 +05:30 · a6e9ca54d6
commit a6e9ca54d6
parent 74e851b996
4 changed files with 63 additions and 30 deletions
--- a/.env.example
+++ b/.env.example
@ -1,25 +1,48 @@
-SECRET_KEY=your-secret-key-here
-DEBUG=False
-ALLOWED_HOSTS=yourdomain.com,www.yourdomain.com
-CSRF_TRUSTED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com
+# Django
+SECRET_KEY=your-secret-key-here-generate-50-random-characters
+DEBUG=True
+ALLOWED_HOSTS=localhost,127.0.0.1,your-domain.com
+CSRF_TRUSTED_ORIGINS=http://localhost:8000,http://127.0.0.1:8000

-# Database
-DB_NAME=netcop_hub
-DB_USER=netcop_user
-DB_PASSWORD=your-db-password
-DB_HOST=localhost
-DB_PORT=5432
+# Database Configuration
+# Default: SQLite (simple, reliable, no setup required)
+# Railway: Automatically uses PostgreSQL via DATABASE_URL

-# Stripe
-STRIPE_SECRET_KEY=sk_live_your_stripe_secret_key
-STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret
+# To use PostgreSQL locally (optional - for production parity):
+# 1. Set up PostgreSQL (see docs/POSTGRESQL_SETUP.md)
+# 2. Uncomment one of these options:

-# AI Assistant Webhooks
-N8N_WEBHOOK_DATA_ANALYZER=your_n8n_webhook_url
-N8N_WEBHOOK_FIVE_WHYS=your_n8n_webhook_url
-N8N_WEBHOOK_JOB_POSTING=your_n8n_webhook_url
-N8N_WEBHOOK_FAQ_GENERATOR=your_n8n_webhook_url
-N8N_WEBHOOK_SOCIAL_ADS=your_n8n_webhook_url
+# Option 1: Use DATABASE_URL (explicit)
+DATABASE_URL=postgresql://user:password@host:port/database

-# OpenWeather API
-OPENWEATHER_API_KEY=your_openweather_api_key
+# Option 2: Use PostgreSQL flag (uses default credentials)
+# USE_POSTGRESQL=True
+
+# Option 3: Force SQLite (override auto-detection)
+# DATABASE_URL=sqlite:///db.sqlite3
+
+# External API Keys
+NEXT_PUBLIC_OPENWEATHER_API_KEY=your_openweather_api_key_here
+OPENWEATHER_API_KEY=your_openweather_api_key_here
+
+# Stripe Configuration
+NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_your_stripe_publishable_key_here
+STRIPE_SECRET_KEY=sk_test_your_stripe_secret_key_here
+STRIPE_WEBHOOK_SECRET=whsec_your_stripe_webhook_secret_here
+
+# N8N Webhook URLs (Frontend)
+NEXT_PUBLIC_N8N_WEBHOOK_DATA_ANALYZER=https://your-n8n-instance.com/webhook/data-analyzer
+NEXT_PUBLIC_N8N_WEBHOOK_FIVE_WHYS=https://your-n8n-instance.com/webhook/five-whys
+NEXT_PUBLIC_N8N_WEBHOOK_JOB_POSTING=https://your-n8n-instance.com/webhook/job-posting
+NEXT_PUBLIC_N8N_WEBHOOK_SOCIAL_ADS=https://your-n8n-instance.com/webhook/social-ads
+NEXT_PUBLIC_N8N_WEBHOOK_FAQ_GENERATOR=https://your-n8n-instance.com/webhook/faq-generator
+
+# Django N8N Webhook URLs (Backend)
+N8N_WEBHOOK_DATA_ANALYZER=https://your-n8n-instance.com/webhook/data-analyzer
+N8N_WEBHOOK_FIVE_WHYS=https://your-n8n-instance.com/webhook/five-whys
+N8N_WEBHOOK_JOB_POSTING=https://your-n8n-instance.com/webhook/job-posting
+N8N_WEBHOOK_SOCIAL_ADS=https://your-n8n-instance.com/webhook/social-ads
+N8N_WEBHOOK_FAQ_GENERATOR=https://your-n8n-instance.com/webhook/faq-generator
+
+# Security
+CSRF_TRUSTED_ORIGINS=https://your-domain.com,https://www.your-domain.com
--- a/docs/AGENT_SETUP_CHECKLIST.md
+++ b/docs/AGENT_SETUP_CHECKLIST.md
@ -150,7 +150,7 @@ print("Agent created:", BaseAgent.objects.filter(slug='pdf-analyzer').exists())
 **Add API credentials for your agent:**
 ```bash
 # Existing variables...
-OPENWEATHER_API_KEY=15befe6bac7b1cd0268900fb97d31482
+OPENWEATHER_API_KEY=your_openweather_api_key_here

 # Add your new agent's API key
 DOCPARSER_API_KEY=your_actual_api_key_here
--- a/netcop_hub/settings.py
+++ b/netcop_hub/settings.py
@ -25,7 +25,17 @@ sys.path.insert(0, str(BASE_DIR / 'apps'))
 # See https://docs.djangoproject.com/en/5.2/howto/deployment/checklist/

 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = config('SECRET_KEY', default='django-insecure-thdd^re4==p$4geq^$52w7%egd0xxrj#fpgk1c+$xt-jrr5d7%')
+SECRET_KEY = config('SECRET_KEY')
+
+# Validate required environment variables
+required_env_vars = ['SECRET_KEY']
+missing_vars = [var for var in required_env_vars if not config(var, default='')]
+if missing_vars:
+    import sys
+    print(f"❌ Missing required environment variables: {', '.join(missing_vars)}")
+    print("💡 Please create a .env file based on .env.example")
+    print("💡 For local development, copy .env.example to .env and fill in the values")
+    sys.exit(1)

 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = config('DEBUG', default=True, cast=bool)
@ -129,11 +139,11 @@ else:
            DATABASES = {
                'default': {
                    'ENGINE': 'django.db.backends.postgresql',
-                    'NAME': 'netcop_hub',
-                    'USER': 'netcop_user',
-                    'PASSWORD': 'netcop_pass',
-                    'HOST': 'localhost',
-                    'PORT': '5432',
+                    'NAME': config('PGDATABASE', default='netcop_hub'),
+                    'USER': config('PGUSER', default='netcop_user'),
+                    'PASSWORD': config('PGPASSWORD'),
+                    'HOST': config('PGHOST', default='localhost'),
+                    'PORT': config('PGPORT', default='5432'),
                }
            }
        except ImportError:
--- a/wallet/stripe_handler.py
+++ b/wallet/stripe_handler.py
@ -35,7 +35,7 @@ class StripePaymentHandler:
            print(f"🚀 [STRIPE DEBUG] Starting checkout session creation...")
            print(f"👤 User: {user.id} ({user.email})")
            print(f"💰 Amount: {amount} AED")
-            print(f"🔑 Stripe API Key (last 4): ...{settings.STRIPE_SECRET_KEY[-4:]}")
+            print(f"🔑 Stripe API Key configured: {bool(settings.STRIPE_SECRET_KEY)}")
            print(f"🔑 API Version: {stripe.api_version}")
            print(f"📍 Success URL: {success_url}")
            print(f"📍 Cancel URL: {cancel_url}")
@ -147,7 +147,7 @@ class StripePaymentHandler:
        """Verify payment directly from Stripe (bypasses webhook issues)"""
        try:
            print(f"🔍 [STRIPE DEBUG] Starting payment verification...")
-            print(f"🔑 Using Stripe API Key (last 4): ...{settings.STRIPE_SECRET_KEY[-4:]}")
+            print(f"🔑 Stripe API Key configured: {bool(settings.STRIPE_SECRET_KEY)}")
            print(f"🔑 API Version: {stripe.api_version}")
            print(f"💳 Session ID to verify: {session_id}")