H.6 — Rotate `BETTER_AUTH_SECRET` on local machines

[v-patel]

H.6 — Rotate BETTER_AUTH_SECRET on local machines

What's wrong

Local .env files contain a real-looking 32-byte hex secret. It was never committed (verified — .env is gitignored), so this is purely hygiene.

How to fix

On each contributor's machine:

openssl rand -hex 32

Replace the value of BETTER_AUTH_SECRET in your local .env with the output. Each deployed environment (staging, production) should already have its own value, distinct from any developer's local.

Files

• Each developer's local .env

Severity

L.

Acceptance

• Each contributor has rotated their local secret at least once.
• Production secret is documented as living in the secrets manager (covered by H.3 deployment docs).

[nevins321]

done