security: remove hardcoded R2 credentials from committed CLAUDE.md

2026-03-19 14:05:33 -07:00
parent 7a6614e83e
commit 6cc1310df5
1 changed files with 1 additions and 1 deletions
@@ -14,7 +14,7 @@ Game art is generated via the Gemini API (`gemini-3-pro-image-preview`, ~$0.134/
 ### Process
 1. Generate images with `curl` to `https://generativelanguage.googleapis.com/v1beta/models/gemini-3-pro-image-preview:generateContent?key=<API_KEY>`, requesting soft-shaded anime style
 2. Save responses to `/home/naomi/code/naomi/elysium/img/<category>/<id>.jpg`
-3. Upload to R2 with: `AWS_ACCESS_KEY_ID=dd0a3d73969143ada84d50f8940cc5e2 AWS_SECRET_ACCESS_KEY=f73e9907da1b2297e93e17f786d6446d33d4ac60e185879578a0d5020899b18e aws s3 sync img/ s3://nhcarrigan-cdn/elysium/ --endpoint-url https://751c386661d378cc032093493cfb0869.r2.cloudflarestorage.com`
+3. Upload to R2 with the AWS CLI — credentials are in the global `~/.claude/CLAUDE.md` (never commit them here)
 4. Delete the local `img/` directory before committing (images live on CDN only)

 ### CDN URL Helper