From c0d3002e22e0c02b3563f484d3c74213d2e2a532 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Sat, 30 May 2026 15:08:01 +0000
Subject: [PATCH] fix: remove hardcoded credentials from .env.example and
 source

- .env.example: placeholder values only
- gemini.go: error on missing API key instead of fallback
- main.go: dynamic from address from SMTP_USER
- Security: old credentials removed from active codebase
---
 .env.example          | 32 +++++++++++++++++---------------
 internal/ai/gemini.go |  2 +-
 main.go               |  2 +-
 3 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/.env.example b/.env.example
index fb12eda..9f10a6f 100644
--- a/.env.example
+++ b/.env.example
@@ -1,27 +1,29 @@
-# ExpenseFlow Configuration
+# ReceiptNext Configuration
 # Copy this file to .env and fill in your credentials.
+# Run `sudo ./install.sh` for interactive setup.
 
-# SMTP Configuration
-SMTP_HOST=smtp.openxchange.eu
-SMTP_PORT=587
-SMTP_USER=post@2-4-h.app
-SMTP_PASS=D9AW8JP74r1V
-
-# --- AI Provider Configuration ---
-# Choose one: gemini (default), openai, ollama
+# --- AI Provider ---
+# Choose one: gemini, openai, ollama
 AI_PROVIDER=gemini
 
-# Gemini (default, used when AI_PROVIDER=gemini)
-GEMINI_API_KEY=AQ.Ab8RN6IQjKTQofuKOW2TT5mZ0zwt8rFa8X3SHGyYyce4DrbBJw
+# For AI_PROVIDER=gemini:
+# GEMINI_API_KEY=your-gemini-api-key
 
-# OpenAI / Compatible (used when AI_PROVIDER=openai)
+# For AI_PROVIDER=openai:
 # OPENAI_API_KEY=sk-...
 # AI_MODEL=gpt-4o-mini
 # AI_BASE_URL=https://api.openai.com/v1
 
-# Ollama - Local LLM (used when AI_PROVIDER=ollama)
+# For AI_PROVIDER=ollama:
 # AI_BASE_URL=http://localhost:11434
-# AI_MODEL=llava
+# AI_MODEL=qwen3.5:2b
 
-# Base URL for generating absolute links in emails
+# --- SMTP (optional — needed for OTP emails and report delivery) ---
+# SMTP_HOST=smtp.example.com
+# SMTP_PORT=587
+# SMTP_USER=your-email@example.com
+# SMTP_PASS=your-password
+
+# --- General ---
+PORT=8080
 BASE_URL=http://localhost:8080
diff --git a/internal/ai/gemini.go b/internal/ai/gemini.go
index d66b6d6..a9681ff 100644
--- a/internal/ai/gemini.go
+++ b/internal/ai/gemini.go
@@ -68,7 +68,7 @@ func (p *geminiProvider) ExtractReceipt(imagePath string) (*ReceiptData, error)
 
 	apiKey := os.Getenv("GEMINI_API_KEY")
 	if apiKey == "" {
-		apiKey = "AQ.Ab8RN6IQjKTQofuKOW2TT5mZ0zwt8rFa8X3SHGyYyce4DrbBJw"
+		return &ReceiptData{}, errors.New("GEMINI_API_KEY environment variable not set")
 	}
 
 	b64Data := base64.StdEncoding.EncodeToString(imageData)
diff --git a/main.go b/main.go
index 3a21742..51ad43d 100644
--- a/main.go
+++ b/main.go
@@ -73,7 +73,7 @@ func main() {
 	// Create the email sender only if SMTP credentials are configured.
 	var emailSender *email.Sender
 	if smtpHost != "" && smtpPort != "" && smtpUser != "" && smtpPass != "" {
-		emailSender = email.NewSender(smtpHost, smtpPort, smtpUser, smtpPass, "post@2-4-h.app")
+		emailSender = email.NewSender(smtpHost, smtpPort, smtpUser, smtpPass, smtpUser)
 		log.Printf("INFO  [%s] main: SMTP sender configured (%s:%s)",
 			time.Now().Format(time.RFC3339), smtpHost, smtpPort)
 	} else {