# Security – Credentials & SSH

Keep WhatsApp credentials and SSH keys out of the repo and off shared machines. Follow these practices.

---

## 1. WhatsApp / Meta credentials

- **Never commit** access tokens, verify tokens, or phone number IDs.
- **Use environment variables only** (e.g. in `backend/unified_server/.env` or your process manager). See `backend/unified_server/.env.example`.
- **Restrict file permissions** on the server:  
  `chmod 600 backend/unified_server/.env`
- If a token is **leaked** (e.g. pushed to git, shared in chat):
  1. Regenerate it in Meta App Dashboard → WhatsApp → API Setup.
  2. Update `.env` on the server and restart the app.
  3. Rotate any other secrets that might have been exposed.
- Prefer **short‑lived tokens** or Meta’s recommended auth flow when available.

---

## 2. SSH keys

- **Do not commit** private keys (`id_rsa`, `hashmi`, etc.) or `.ppk` files.
- **Do not store** private keys in the project folder or in any repo.
- Keep keys in `~/.ssh/` (or your OS equivalent) with strict permissions:
  - `chmod 700 ~/.ssh`
  - `chmod 600 ~/.ssh/hashmi` (private key)
  - `chmod 644 ~/.ssh/hashmi.pub` (public key is safe to share for server auth)
- Use a **passphrase** for the private key. Prefer an agent (e.g. `ssh-agent`) so you don’t type it everywhere.
- **Server access**: Add only the **public** key to `~/.ssh/authorized_keys` on the server; never put the private key on the server.
- If a **private key is compromised**: Generate a new key pair, add the new public key to the server, remove the old one from `authorized_keys`, and revoke the old key everywhere.

---

## 3. Repository and deployment

- `.gitignore` is set to exclude `.env`, `.env.*`, `*.pem`, `*.key`, and common secret paths (see repo root and backend/frontend).
- Do not disable or override these exclusions for real credentials.
- For deployment, set env vars on the server (or in your CI/hosting) from a secure store (e.g. secrets manager), not from a file committed to the repo.
- Restrict who can read deployment secrets and SSH keys (principle of least privilege).

---

## 4. Quick checklist

- [ ] No `.env` or real tokens in git history.
- [ ] WhatsApp credentials only in server env (or secure vault).
- [ ] SSH private key only on your machine, not in the project or on the server.
- [ ] File permissions: `600` for `.env` and private keys, `700` for `~/.ssh`.
- [ ] If anything was exposed: rotate tokens and keys, then update server and access lists.