An Emergent app commits a live secret in backend/.env

Symptom

backend/.env is in the repository, and it holds a third-party API key or a JWT signing secret rather than an empty placeholder.

Root cause

A DevOps Genie audit published on September 28, 2026 read public repositories only. It sent no request to a running app. For Emergent it kept a random sample of repositories active in 2025 or 2026, one per owner, excluding forks, archived repositories, and templates, identified by the emergentintegrations package, a test_result.md file, and a backend/ plus frontend/ layout. That sample was 65 Emergent apps. The published aggregate, not a finding about one named app, is that 15 of those 65 commit a credential that looks real, most often a third-party API key or the JWT signing secret in backend/.env. The audit says anyone who can read the repository can use it, and that a signing secret can be used to create valid sessions. Deleting the file later does not remove the value from git history. The same page says to treat the numbers as how often the problem is written into the code, not as a count of breached apps, and that public repositories may differ from private ones. It says to rotate anything that was ever committed.

In this repository only. Do not open any other repository, and do not print secret values.

1. Check whether backend/.env is tracked by git, and whether it appears in git history. Report file paths and key names only.
2. If a value looks like a real API key or a JWT signing secret, stop and tell me to rotate it at the provider. Do not reuse it in a new file.
3. Remove the committed file from the tree and ignore it. Tell me that deleting the current file leaves the old value in history, so rotation still has to happen.
4. Keep production secrets in Emergent's Secrets tab, not in a committed .env.

Do not echo the values into the chat.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own Emergent project, run git ls-files and git log for backend/.env. If the file was ever committed, treat every real value in it as exposed.
2. Rotate those keys at the provider that issued them, including a JWT signing secret. Do not paste the old values into chat.
3. Confirm the replacement values are set in your own project's Secrets tab for the live app, and that backend/.env is not staged in git status.

Sources

• DevOps Genie: audit of public Lovable and Emergent apps (September 28, 2026)