Kisa 25f65326d4 security: rotate leaked Signal API key, remove it from frontend + source ... The backend master SIGNAL_API_KEY had leaked via two paths: - baked into the public Vite bundle via VITE_SIGNAL_API_KEY (Vercel) - hardcoded as a fallback in scripts/signal_e2e_test.py The key has been rotated on Railway (old value now returns 401) and the VITE_SIGNAL_API_KEY var removed from Vercel. This commit removes the two code paths so the master key can never be re-baked or re-committed: - signal-ui/src/lib/api.js: drop the X-API-Key fallback entirely; the frontend now authenticates only with the signed-in user's Clerk token - scripts/signal_e2e_test.py: read SIGNAL_API_KEY from env only; exit if unset Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-21 14:00:54 -04:00
..
signal_e2e_test.py	security: rotate leaked Signal API key, remove it from frontend + source	2026-06-21 14:00:54 -04:00