ClassroomCopilot/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: remove VITE_TLSYNC_SECRET from frontend bundle

Browse Source 
- Remove import.meta.env.VITE_TLSYNC_SECRET from syncService.ts
- Add optional token parameter to SyncConnectionOptions interface
  (caller passes token fetched from API, not a baked-in secret)
- Add clientEnvBlocklist in vite.config.ts to prevent sensitive VITE_
  env vars (TLSYNC_SECRET, MICROSOFT_CLIENT_SECRET*) from reaching bundle
- Remove VITE_TLSYNC_SECRET from .env.example
- Token auth for TLSync now handled server-side or via API endpoint

Ref: t_99d166c6
This commit is contained in:
kcar
2026-05-28 13:51:46 +01:00
parent 0db53bfd9c
commit 0d76868a42
3 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
-1
View File
@@ -27,7 +27,6 @@ VITE_SUPABASE_ANON_KEY=your-supabase-anon-key
# TLSync (TLDraw Sync) Configuration
# =============================================================================
VITE_TLSYNC_URL=https://app.classroomcopilot.ai/tldraw
VITE_TLSYNC_SECRET=your-tlsync-secret
# =============================================================================
# WhisperLive (Transcription) Configuration