.env.example

# Copy to .env — never commit real values.
NODE_ENV=development
PORT=5000

# Required in production (min 32 characters)
SESSION_SECRET=

DATABASE_URL=postgresql://user:pass@localhost:5432/codeguard

OPENAI_API_KEY=

# GitHub OAuth
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_CALLBACK_URL=http://localhost:5000/auth/github/callback

# OAuth token encryption keyring (key rotation-ready).
# Format: keyId:base64_32_byte_key[,oldKeyId:base64_32_byte_key]
# Generate a key:
# node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
TOKEN_ENCRYPTION_KEYS=

# Optional: server-side GitHub API (webhooks use app token path)
GITHUB_TOKEN=

# Comma-separated browser origins allowed for CORS (production)
# Example: https://app.example.com,https://www.example.com
APP_ORIGIN=http://localhost:5000

# Optional: allow GET /api/test-github-auth when true AND user is signed in (default off)
# ENABLE_DEBUG_GITHUB_AUTH=false

# Optional workflow integrations
SLACK_WEBHOOK_URL=
PAGERDUTY_ROUTING_KEY=
LINEAR_API_KEY=
LINEAR_TEAM_ID=
JIRA_BASE_URL=
JIRA_EMAIL=
JIRA_API_TOKEN=
JIRA_PROJECT_KEY=