env-key-guard

name	env-key-guard
description	Guard rules for GROQ_API_KEY handling in ai_feedback.py and the .env file. Check before reading, printing, logging, or committing anything near the key.
user-invocable	false

GROQ_API_KEY lives in .env (gitignored) and is read in ai_feedback.py via os.getenv("GROQ_API_KEY", ""). This repo is public on GitHub, so a leak here is a real leak.

• Never cat, Read, or print .env. If you need to check the key exists, check os.getenv("GROQ_API_KEY") truthiness only — never its value.
• Never put the key value in a log line, commit message, error message, or code comment. _log_ai_error already logs failures without the key — keep new error paths the same way.
• Never write the key into a file other than .env (no hardcoding into ai_feedback.py, no committing a .env.example with a real value — placeholder only).
• Before any git add/commit in this repo, confirm .env isn't staged (git status) — it's gitignored but a git add -f or path typo could still catch it.
• ai_feedback.py::_load_environment() has a manual .env parser fallback for when python-dotenv isn't installed — if editing it, preserve that it skips comments/blank lines and never overwrites a var already set in os.environ.