This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-app`](https://nextjs.org/docs/app/api-reference/cli/create-next-app).

## Getting Started

First, run the development server:

```bash
npm run dev
# or
yarn dev
# or
pnpm dev
# or
bun dev
```

Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.

You can start editing the page by modifying `app/page.tsx`. The page auto-updates as you edit the file.

This project uses [`next/font`](https://nextjs.org/docs/app/building-your-application/optimizing/fonts) to automatically optimize and load [Geist](https://vercel.com/font), a new font family for Vercel.

## Learn More

To learn more about Next.js, take a look at the following resources:

- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.
- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.

You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js) - your feedback and contributions are welcome!

## Deploy on Vercel

The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js.

Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details.

## Secret safety

- Keep credentials in `.env` or `.env.local`. Never prefix a credential with
  `NEXT_PUBLIC_`.
- Restrict local access before starting the app:

  ```bash
  chmod 600 .env .env.local
  ```

- Scan tracked files and Git history before deployment:

  ```bash
  bun run secrets:scan
  ```

- Deploy with Docker Compose so `.env` is injected only when the container
  starts. Environment files are excluded from the Docker build context.
- Give the Discord bot only the permissions it needs. Avoid the Administrator
  permission.
- Rotate every credential from `.env` if an environment file, build context,
  builder cache, log, or host may have been shared. If prior exposure cannot be
  ruled out, treat the credentials as exposed.

# erika