security: Remove API keys from config.js, block sensitive files in nginx

Author: Programcode

nginx.conf

@@ -20,6 +20,18 @@ server {
         add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
     }
 
+    # SECURITY: Block access to sensitive files
+    location ~* \.(md|txt|env|log|yml|yaml|json|lock|git|gitignore|dockerignore)$ {
+        deny all;
+        return 404;
+    }
+
+    # SECURITY: Block hidden files and directories
+    location ~ /\. {
+        deny all;
+        return 404;
+    }
+
     location / {
         try_files $uri $uri/ /index.html;
     }

public/config.js

@@ -1,5 +1,6 @@
+// Runtime configuration for DebateLab
+// Note: API keys are stored securely in the Supabase Edge Function
+// This file only contains non-sensitive frontend configuration
 window.env = {
-  VITE_OPENAI_API_KEY: "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",
-  VITE_GOOGLE_API_KEY: "AIzaSyBeO-POlfAiaRECM6aFahxtsvVD5qRlUz4",
-  VITE_ANTHROPIC_API_KEY: "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"
+  // No API keys needed - all AI calls go through the authenticated Edge Function
 };

supabase/functions/ai/index.ts

@@ -55,6 +55,7 @@ const PROMPT_INJECTION_PATTERNS = [
 
 function sanitizePromptInput(input: string, fieldName: string): { sanitized: string } | { rejected: string } {
   if (typeof input !== "string") return { sanitized: "" };
+  // eslint-disable-next-line no-control-regex
   let sanitized = input.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
   for (const pattern of PROMPT_INJECTION_PATTERNS) {
     if (pattern.test(sanitized)) {