# Environment Variable Audit

> Generated on 2026-03-19 — 14 variable(s) detected.
> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19

## Security Recommendations

- **[CRITICAL]** Public env vars with secret-looking names (exposed to client): NEXT_PUBLIC_SUPABASE_ANON_KEY, NEXT_PUBLIC_POSTHOG_KEY

## Environment Variables

### API Key / Secret

| Variable | Found In | Has Value |
|----------|----------|-----------|
| `OPENAI_API_KEY` | .env.example, src/app/api/chat/route.ts | Yes |
| `RESEND_API_KEY` | .env.example | Yes |
| `SENTRY_AUTH_TOKEN` | .env.example | Yes |
| `STRIPE_PUBLISHABLE_KEY` | .env.example | Yes |
| `STRIPE_SECRET_KEY` | .env.example, src/app/api/checkout/route.ts | Yes |
| `STRIPE_WEBHOOK_SECRET` | .env.example | Yes |
| `SUPABASE_SERVICE_ROLE_KEY` | .env.example | Yes |

### Database

| Variable | Found In | Has Value |
|----------|----------|-----------|
| `DATABASE_URL` | .env.example | Yes |

### Public / Client-side

| Variable | Found In | Has Value |
|----------|----------|-----------|
| `NEXT_PUBLIC_POSTHOG_HOST` | .env.example | Yes |
| `NEXT_PUBLIC_POSTHOG_KEY` | .env.example | Yes |
| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | .env.example | Yes |
| `NEXT_PUBLIC_SUPABASE_URL` | .env.example | Yes |
| `NEXT_PUBLIC_URL` | .env.example, src/app/api/checkout/route.ts | Yes |

### Other

| Variable | Found In | Has Value |
|----------|----------|-----------|
| `SENTRY_DSN` | .env.example | Yes |

---

*This audit was generated by [Codepliant](https://github.com/joechensmartz/codepliant). It is not a substitute for a professional security review.*
