Rotate leaked Trustless Work API key committed in `.env.example`

[grantfox-oss]

Problem

app/api/.env.example has what appears to be a real API key committed to the repo (TW_API_KEY=7p9eNvg2VFR6...).

Expected behavior

• Rotate/revoke the exposed key with Trustless Work.
• Replace the value in .env.example with a placeholder, e.g. TW_API_KEY=your_api_key_here.
• Confirm the real key is only ever stored in untracked .env files or secret managers.

Priority

High — this is a credential leak and should be handled before other Trustless Work work lands.

[midenotch]

I'd like to work on this issue.

This is an important security issue, and my approach is to ensure the repository no longer exposes any sensitive credentials while preserving a smooth developer onboarding experience. I'll replace the committed API key in app/api/.env.example with a clear placeholder (e.g. TW_API_KEY=your_api_key_here) and verify that example configuration files contain no real secrets.

If I have the necessary access, I'll also coordinate the rotation and revocation of the exposed Trustless Work API key, confirm that production credentials are stored only in untracked .env files or a secure secrets manager, and verify that no other hardcoded secrets exist in the repository. If repository or service permissions are required for key rotation, I'll prepare the code changes and notify the maintainers so the credential can be rotated safely.

Finally, I'll validate that the application continues to function correctly using environment variables and that the updated example configuration remains accurate for new contributors.

[grantfox-oss]

🦊 GrantFox — @midenotch has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #318)
2. Your PR will be reviewed by the Kaizenode maintainers

Good luck! Track your progress on GrantFox.