Security: Hardcoded API Key

[Patrick-Ehimen]

Priority: High 🔴

⚡ Immediate Actions Required:

• REVOKE THE API KEY in your Brevo dashboard immediately
• Generate a new API key
• Remove the hardcoded key from the code
• Use environment variables instead

🎯 Impact:

• Anyone with access to your repository can use your email service
• Potential for email spam/abuse using your account
• Risk of exhausting your email quota
• Possible access to your email templates and subscriber data

File: utils/services/emailService.js

Suggested Fix:

• Replace the hardcoded key with:

const brevo_key = process.env.BREVO_API_KEY;

if (!brevo_key) {
  throw new Error('BREVO_API_KEY environment variable is required');
}

• Move API keys to environment variables

• Add server-side API route to handle email sending