How should I manage Supabase dotenv keys locally without committing secrets?

[NITISH-R-G]

I see RoadSOS loads dotenv from assets/.env in lib/main.dart, and there is also an assets/env.template.

What is the intended workflow for:

• setting SUPABASE_URL / SUPABASE_ANON_KEY / POWERSYNC_URL for local dev
• avoiding accidentally committing secrets in a public repo
• keeping CI/builds stable (assets must exist)

Also: where should Gemini keys live for the AI triage flow?

[NITISH-R-G]

Recommended workflow

• Keep assets/.env in the repo as a blank template (safe defaults) so Flutter builds + CI always have the asset present. Do not put real secrets in it.
• For local dev, edit assets/.env in your working copy with your project’s SUPABASE_URL, SUPABASE_ANON_KEY, and POWERSYNC_URL, and never commit the filled file.
• If you’re contributing frequently, a good habit is to run git status before every commit and ensure assets/.env is unchanged (or revert it).

Why this repo uses assets/.env

Flutter’s flutter_dotenv loads from an asset bundle, so the file must exist at build time. That’s why we keep a blank placeholder committed.

What scripts/setup.ps1 does

• Ensures you have Flutter
• Runs flutter pub get
• Ensures assets/.env exists (created from assets/env.template if missing)

Gemini key handling (important)

• Do not ship Gemini keys in the mobile client.
• Put Gemini secrets in Supabase Edge Function secrets (server-side). The client should call the Edge Function and receive only the structured response.

Extra safety notes

• The anon key is not a “secret”, but it should still be treated carefully and paired with strict RLS policies.
• Prefer short-lived, server-issued tokens for any privileged dispatch/triage operations.

If you’re seeing runtime issues, double-check that assets/.env is present and that SUPABASE_URL / SUPABASE_ANON_KEY are non-empty.