This lesson's interactive features are locked, please to keep using them

Protecting Secrets

Moving a secret out of source code is only the first step. Local files that contain injected secrets also need to stay out of version control.

As a general rule, environment files should be ignored:

.env*
!.env.example

A committed .env.example conventionally documents the expected names with dummy values:

APP_ORIGIN=http://localhost:3030
PAWPAL_API_KEY=replace_with_your_pawpal_api_key

Developers can copy that template to .env and supply their own local values. In Go, a package such as godotenv can read the file during startup. Load .env first and then overlay the process environment so an explicitly injected value takes precedence.

Assignment

Bearly Secure requires runtime configuration but does not safely load local environment files. Add a protected local configuration workflow and use a stable download-signing key.

Add github.com/joho/godotenv to the module and use it in internal/config/config.go to read .env when the file exists.
Overlay the process environment on the file values so process variables take precedence. Use the resulting environment in both Load and LoadAttackerLab.
Require DOWNLOAD_SIGNING_KEY and decode it as exactly 64 hexadecimal characters into a [32]byte. Return an error for any other value.
Add the signing key to config.Config and httpserver.Options, then pass it from cmd/server/main.go to the HTTP server instead of generating a random key at startup.
Add DOWNLOAD_SIGNING_KEY=replace_with_64_hex_characters to .env.example.
Ignore every .env variant while keeping .env.example tracked.
Copy .env.example to .env and replace its placeholders with valid dummy values. You can generate a signing key with:
```
openssl rand -hex 32
```
Start the app without inline environment variables:
```
go run ./cmd/server
```

With Bearly Secure still running, run and submit the CLI tests from a separate terminal in the project root.