> Generated on 2026-03-19 — 14 variable(s) detected. Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## Security Recommendations

- [CRITICAL] Public env vars with secret-looking names (exposed to client): NEXTPUBLICSUPABASEANONKEY, NEXTPUBLICPOSTHOG_KEY

## Environment Variables

### API Key / Secret

Variable | Found In | Has Value
--- | --- | ---
`OPENAIAPIKEY` | .env.example, src/app/api/chat/route.ts | Yes
`RESENDAPIKEY` | .env.example | Yes
`SENTRYAUTHTOKEN` | .env.example | Yes
`STRIPEPUBLISHABLEKEY` | .env.example | Yes
`STRIPESECRETKEY` | .env.example, src/app/api/checkout/route.ts | Yes
`STRIPEWEBHOOKSECRET` | .env.example | Yes
`SUPABASESERVICEROLE_KEY` | .env.example | Yes

### Database

Variable | Found In | Has Value
--- | --- | ---
`DATABASE_URL` | .env.example | Yes

### Public / Client-side

Variable | Found In | Has Value
--- | --- | ---
`NEXTPUBLICPOSTHOG_HOST` | .env.example | Yes
`NEXTPUBLICPOSTHOG_KEY` | .env.example | Yes
`NEXTPUBLICSUPABASEANONKEY` | .env.example | Yes
`NEXTPUBLICSUPABASE_URL` | .env.example | Yes
`NEXTPUBLICURL` | .env.example, src/app/api/checkout/route.ts | Yes

### Other

Variable | Found In | Has Value
--- | --- | ---
`SENTRY_DSN` | .env.example | Yes

This audit was generated by Codepliant. It is not a substitute for a professional security review.