Security Notices
Check whether a project created by an affected 01.software tool needs credential rotation.
Security Notices
Use this page to check your own project against a published notice and to rotate any credential it names.
Committed .env.local in apps created with an affected version
Projects created by the versions below arrived without a .gitignore. The creator wrote a live credential to .env.local in the project directory, so a first git add . could commit it. A committed credential stays readable to anyone who can read the repository or its history.
| Package | Affected versions |
|---|---|
@01.software/init | 0.10.0, 0.10.1, 0.11.0 |
create-01-software-app | 0.2.0; 0.2.1 when it was run before 2026-08-10 |
@01.software/init 0.11.2 and later create the project with ignore rules that cover env files. Upgrading protects new projects only. Check every existing project created with an affected version. If you are unsure which version created a project, run the check anyway.
Check your project
Run both commands in the project root:
git ls-files --error-unmatch .env.local
git log --all --oneline -- .env.local| Result | Next action |
|---|---|
| The first command reports an error and the second prints none | The file was never committed. Add the ignore rule below and stop here |
| Either command prints a path or a commit | Treat every value in the file as exposed and follow the steps below |
| The repository was pushed to a shared or public remote | Rotate first. Rewriting history does not recall copies others already have |
Rotate the exposed credentials
Read the prefix of SOFTWARE_SECRET_KEY in .env.local. Never paste the full value into a message, issue, or chat. If the value is empty or missing, continue with the other credentials below the table.
| Prefix | What it is | How to replace it |
|---|---|---|
sk01_ | Workspace Secret Key | A tenant-admin opens API Keys in Console, issues a replacement, updates the app, then revokes the old key. Match the old key by the first and last characters shown in the list |
pat01_ | Personal access token of the person who signed in | The person who signed in selects the profile icon (Account) at the top right of Console and revokes it under Personal access tokens. Match the token by the first 12 and last 4 characters shown in the list. If they cannot sign in, email software@01.works from the account's email address with only the first 12 characters, and a platform super-admin revokes it. An unrevoked token can stay valid for up to 90 days from issuance. Use a Secret Key for the app instead |
A personal access token acts with the signed-in person's current workspace
role. A token issued by browser sign-in went only to a tenant-admin. Revoke
it as soon as you find one in a committed file.
Replace the other credentials in the same file as well. Payment provider keys you added yourself need rotation with that provider. Ecommerce and Events projects created with 0.11.0 also hold generated checkout values:
CHECKOUT_COOKIE_SECRETS: set it to one new 32-byte base64url key only. Do not keep the exposed key as the previous key. Recovery cookies for checkouts in progress stop working.CHECKOUT_WEBHOOK_IDEMPOTENCY_SECRET: this is not an authentication secret, and the starter guidance keeps it stable. Change it only when no provider webhook retries are pending.
Stop tracking the file
- Add
.env*to.gitignore. New projects ship with the same rule. - Run
git rm --cached .env.localand commit the change. The file stays on disk. - To remove the file from earlier commits, follow GitHub's guide on removing sensitive data from a repository. Rotation is still required after a history rewrite.
Next Actions
- Review credential ownership in Integrations & Keys.
- Configure the replacement Secret Key with Authentication & Keys.