Security & secrets

Layers

Layer	Holds
GitHub Secrets	Values injected into CI as TF_VAR_* / env for deploy.sh
Terraform / Lambda env	Runtime configuration on API Lambda (non-secret + secret names)
build/configs/env.js	Local dev defaults — Brightcove tokens, names of secrets, non-production-safe values
.env (developer machine)	Unmoxed token, personal overrides — never commit

What not to commit

• API keys, JWT signing secrets, private PEMs, internal passwords.
• Production Brightcove or partner tokens — use secret manager or TF variables per environment.

Logging

• moxie.log should never include raw tokens or PII unless explicitly approved and redacted.
• debugga output can expose URLs — use on non-prod or controlled sessions.

Dependency surface

• Single bundle reduces runtime dependency attacks; still run Dependabot / security reviews on package.json.

IAM

• Lambda execution role permissions are least-privilege by convention — new S3 paths or VPC resources need Terraform updates.

Related

• Local development
• Infrastructure & CI/CD