Secrets and identity

Local development

Use uncommitted environment variables only for bounded local tests. Never place API keys in source, examples, issue text, or committed environment files.

Google Cloud

Store production and shared-development secrets in Secret Manager under the approved Vandoko project. Assign a dedicated service account to each deployed tool and grant only the secrets and roles its task requires.

Site authentication

The public site's sign-in action and /login route link to the staff control plane at https://build.vandoko.ai. They do not create a public-site account. Password recovery remains disabled on this public site.

Contact submissions

/signup is a contact form, not account registration. When its mail configuration and Vercel Firewall rules are enabled, it submits your name, email address, audience selection, and supplied meeting or contact details to /api/connect. The server validates the fields and requires both per-IP and shared admission checks before sending a plain-text notification through Resend to the configured recipient. Your email address is used as the reply-to address.

Missing configuration, missing firewall rules, or admission-service failures prevent delivery. Rate-limited requests are rejected. Local development does not bypass these checks to send mail. No account, login session, or automatic mailing list subscription is created by this submission.

Operators must configure and verify the rules and mail settings before enabling delivery; see apps/templates/scalar-nextjs/CONTACT.md in the repository. Rule publication and production deployment require separate approval. Connecting a public-site identity provider also requires an approved authentication design.