security: remove hardcoded API keys and environment setup

[MikeVenge]

Summary

Removes all hardcoded Fireworks AI API keys from codebase and implements secure environment variable-based configuration. Adds comprehensive security documentation and enhanced git ignore patterns to prevent future credential leaks.

Changes

• Replaced hardcoded API keys with FIREWORKS_API_KEY environment variable in Python and shell scripts
• Added validation and helpful error messages when API key is missing
• Enhanced .gitignore with comprehensive credential file patterns (*.env, *.key, *.pem, secrets/, etc.)
• Updated 6 documentation files to use placeholders and reference secure key management
• Created SECURITY_MIGRATION.md with complete remediation guide covering key revocation, generation, git history scrubbing, and team coordination
• Created SECURITY_REMEDIATION_SUMMARY.md with actionable checklist and verification steps

Testing

• Verify scripts fail gracefully when FIREWORKS_API_KEY is not set
• Confirm scripts work correctly with environment variable set
• Validate no hardcoded keys remain in codebase: grep -r "fw_[a-zA-Z0-9]" . --exclude-dir=.git
• Check .gitignore patterns cover credential files

Notes

⚠️ CRITICAL - Manual Actions Required:

Phase 1 (IMMEDIATE):

• Revoke exposed API keys from Fireworks AI dashboard:
  • fw_3ZNkrZnbfKVHhU65bFirkpJr
  • fw_3ZHFp8ZR5WeoadXcFcjEKY4z
• Generate new API keys with least privilege scope

Phase 2 (TODAY):

• Scrub git history using git-filter-repo or BFG (see SECURITY_MIGRATION.md)
• Force push cleaned history: git push origin --force --all
• Notify all team members to re-clone repository

Phase 3 (THIS WEEK):

• Update production environments (Railway, Vercel) with new keys
• Implement prevention measures (git-secrets pre-commit hooks)
• Verify scrubbing success with historical searches

See SECURITY_MIGRATION.md and SECURITY_REMEDIATION_SUMMARY.md for detailed instructions and checklists.

---

Related: Security remediation for exposed API credentials

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
pddl	Ready	Preview, Comment	Dec 19, 2025 5:03pm