fix(security): remove hardcoded Logo.dev publishable key (GH-192)

[dennisofficial]

GH-192 — Live Logo.dev API key hardcoded in this PUBLIC repo

Glass House finding: EXPOSED_SECRET, P1, CONFIRMED.

A live Logo.dev publishable key (pk_AZat…) was hardcoded at apps/example/src/app/(app)/vendors/vendors.data.ts:11 and inlined into 8 story URLs in apps/storybook/stories/OrganizationSelector.stories.tsx. Verified live at filing time: a GET to img.logo.dev with the key returned 200. Because this repo is public, anyone could drive traffic against Comp AI's Logo.dev account, exhausting or inflating its quota/billing.

Fix

• vendors.data.ts: key replaced with process.env.NEXT_PUBLIC_LOGO_DEV_TOKEN; when unset, logo URLs are built without a token.
• OrganizationSelector.stories.tsx: 8 token-inlined URLs replaced with a logoDev() helper reading import.meta.env.STORYBOOK_LOGO_DEV_TOKEN (added stories/vite-env.d.ts for typing).
• Added apps/example/.env.example documenting the variable (with a .gitignore exception, since .env* is ignored there).

No git history was rewritten.

🚨 Needs human action — not done by this PR

The leaked key is live and remains in the git history of this public repo. Removing it at HEAD does not revoke it. A human must:

1. Rotate the key at the Logo.dev dashboard — the committed key must be considered compromised.
2. Restrict the new key by domain/referrer in the Logo.dev dashboard so a leaked publishable key cannot be driven from arbitrary origins.
3. Set NEXT_PUBLIC_LOGO_DEV_TOKEN (example app) / STORYBOOK_LOGO_DEV_TOKEN (Storybook) locally where live logos are wanted.

Verification

• pnpm --filter @comp/example typecheck — passes.
• Storybook tsc --noEmit — zero errors in changed files (18 errors elsewhere are identical on clean origin/main, pre-existing).
• Unit tests (vitest run --project unit): 126/130 pass — the 4 failures (Badge/Button class assertions) are identical on clean origin/main, pre-existing.
• grep -rn "pk_AZat" over the tree: no matches.

---

Summary by cubic

Removes the hardcoded Logo.dev publishable key from the example app and Storybook, replacing it with environment variables so no real token is committed to this public repo.

• vendors.data.ts now reads NEXT_PUBLIC_LOGO_DEV_TOKEN and builds token-less logo URLs when it is unset.
• Storybook stories use a logoDev() helper backed by STORYBOOK_LOGO_DEV_TOKEN, with typings added via vite-env.d.ts.
• Adds apps/example/.env.example documenting the variable and a .gitignore exception for it.

Action required: the leaked key remains valid and is still in git history. Rotate it at the Logo.dev dashboard and restrict the new key by domain/referrer.

^{Written for commit 66aed88. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
design-system-storybook	Ready	Preview	Sep 22, 2026 3:46pm UTC