Remove exposed APP_KEY from dev branch

.env.example

@@ -1,5 +1,6 @@
 APP_ENV=local
-APP_KEY=base64:ilyL17PxJTnZXqNBVr+P36ARu9NF7HgqJ87ciGWvo5E=
+# Generate with: php artisan key:generate
+APP_KEY=
 APP_DEBUG=false
 APP_TIMEZONE=UTC
 APP_URL=http://localhost
@@ -16,10 +17,24 @@ BCRYPT_ROUNDS=12
 
 DB_CONNECTION=sqlite
 DB_DATABASE=database/database.sqlite
+# Deployed environments use mysql and need the following instead:
+# DB_CONNECTION=mysql
+# DB_HOST=127.0.0.1
+# DB_PORT=3306
+# DB_USERNAME=
+# DB_PASSWORD=
+# Used only by the opt-in mysql_testing connection in phpunit.xml
+# DB_DATABASE_TESTING=
+
+REDIS_HOST=127.0.0.1
+REDIS_PORT=6379
+REDIS_PASSWORD=
 
 CACHE_STORE=array
 SESSION_DRIVER=array
-QUEUE_DRIVER=sync
+# QUEUE_CONNECTION, not QUEUE_DRIVER: the old Laravel 4/5 name is ignored by the
+# framework. Must not be 'sync' on any deployed environment.
+QUEUE_CONNECTION=sync
 
 SCOUT_DRIVER=null
 ALGOLIA_APP_ID=
@@ -29,8 +44,8 @@ ALGOLIA_SECRET=
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 AWS_DEFAULT_REGION=eu-west-1
-AWS_BUCKET=codeweek-dev
-AWS_URL=https://codeweek-s3.s3.amazonaws.com/
+AWS_BUCKET=
+AWS_URL=
 
 LOG_CHANNEL=stack
 LOG_STACK=single
@@ -48,6 +63,88 @@ SESSION_DOMAIN=null
 
 AUTH_MODEL=App\User
 
+# ---------------------------------------------------------------------------
+# Mail. Required in every deployed environment; the app sends certificates,
+# contact form submissions and moderation notices.
+# ---------------------------------------------------------------------------
+MAIL_MAILER=smtp
+MAIL_HOST=
+MAIL_PORT=587
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_ENCRYPTION=tls
+MAIL_FROM_ADDRESS=
+MAIL_FROM_NAME="EU Code Week"
+# Falls back to ADMIN_EMAIL when unset
+CONTACT_FORM_RECIPIENT_EMAIL=
+
+# ---------------------------------------------------------------------------
+# Social login. LoginController allowlists twitter, github, google, facebook.
+# ---------------------------------------------------------------------------
+TWITTER_CLIENT_ID=
+TWITTER_CLIENT_SECRET=
+TWITTER_REDIRECT=
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+GITHUB_REDIRECT=
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GOOGLE_REDIRECT=
+FACEBOOK_CLIENT_ID=
+FACEBOOK_CLIENT_SECRET=
+FACEBOOK_REDIRECT=
+
+# ---------------------------------------------------------------------------
+# Maps and geolocation
+# ---------------------------------------------------------------------------
+MAPS_MAPBOX_ACCESS_TOKEN=
+MAP_TILES=
+MAXMIND_USER_ID=
+MAXMIND_LICENSE_KEY=
+IPAPI_KEY=
+
+# ---------------------------------------------------------------------------
+# Certificates. PDFLATEX_PATH must point at a real pdflatex binary or the
+# whole certificate pipeline fails. See docs/handover/08-certificates.md
+#
+# CERTIFICATE_ADMIN_EMAILS is a comma-separated allowlist for
+# /admin/certificate-backend/*. No role grants access, so if this is blank
+# the certificate backend is closed to everyone.
+# ---------------------------------------------------------------------------
+PDFLATEX_PATH=
+CERTIFICATE_ADMIN_EMAILS=
+
+# ---------------------------------------------------------------------------
+# Storage. RESOURCES_BUCKET is a second bucket for Learn & Teach PDFs, and is
+# commonly pointed at production even on dev - check before importing.
+# ---------------------------------------------------------------------------
+FILESYSTEM_CLOUD=s3
+RESOURCES_BUCKET=
+RESOURCES_URL=
+# Bulk event/user upload temp files — Amazon S3 so every web node/worker sees them.
+# Use local only for single-machine development without AWS.
+BULK_UPLOAD_TEMP_DISK=s3
+RESOURCES_IMPORT_TEMP_DISK=local
+
+# ---------------------------------------------------------------------------
+# Bot protection (Cloudflare Turnstile). Either TURNSTILE_SECRET or
+# TURNSTILE_SECRET_KEY is accepted; verification is skipped when both are blank.
+# ---------------------------------------------------------------------------
+TURNSTILE_SITEKEY=
+TURNSTILE_SECRET=
+
+# ---------------------------------------------------------------------------
+# Partner feeds and integrations
+# ---------------------------------------------------------------------------
+BLOG_URL=
+EEDUCATION_CLIENTID=
+RELOCATION_COUNTRY=
+# Bearer token for the internal support API
+SUPPORT_SERVICE_TOKEN=
+
+# Error monitoring
+SENTRY_LARAVEL_DSN=
+
 # ---------------------------------------------------------------------------
 # Support AI copilot (Phase 1: AI triage + frontend code PRs)
 # ---------------------------------------------------------------------------

devspace/.env.devspace

@@ -1,5 +1,5 @@
 APP_ENV=local
-APP_KEY=base64:R7ErAo+lGcenuwxia/CG4raozxe7lYviGc7gHizfUHw=
+APP_KEY=
 APP_DEBUG=true
 APP_URL=https://codeweek.local.europa.eu
 FORCE_HTTPS=true
@@ -8,7 +8,7 @@ DB_CONNECTION=mysql
 DB_HOST=mysql
 DB_PORT=3306
 DB_USERNAME=codeweek
-DB_PASSWORD=pass123
+DB_PASSWORD=
 DB_DATABASE=codeweek
 
 CACHE_STORE=file
@@ -26,8 +26,8 @@ ALGOLIA_SECRET=
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 AWS_DEFAULT_REGION=eu-west-1
-AWS_BUCKET=codeweek-dev
-AWS_URL=https://codeweek-s3.s3.amazonaws.com/
+AWS_BUCKET=
+AWS_URL=
 
 LOG_CHANNEL=stack