Fix a secret key committed to source

Rules: `secret/*` (Stripe, Anthropic, OpenAI, AWS, GitHub, Slack, Google, SendGrid, private keys)

What muster-check saw

``` CRIT AWS access key ID committed to source src/api.ts:3 AKIAABCDEFGH… ``` The match is a live-key shape (e.g. `AKIA` + 16 chars). The tool only prints the first 12 characters.

Why it matters

A key in git history is readable by anyone with repo access, forever, including after you delete the line. If the repo is or was public, assume it was scraped. If the file ships to the browser, severity is raised to critical because every visitor can read it.

Fix, in this order

1. Rotate the key at the provider first. Deleting the line does not un-leak it.
2. Move the new key to a server-only environment variable (`process.env.STRIPE_SECRET_KEY`, no public prefix). Add `.env*` to `.gitignore`.
3. Remove the old value from code. Optional: rewrite history with `git filter-repo` only after rotation, since forks and clones keep the old value.
4. Add the check to pre-commit: `npx muster-check --fail-on critical`.

```ts // before const stripe = new Stripe("sk_live_…"); // after (server code only) const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!); ```

Prove it's fixed

• Re-run `npx muster-check`; the finding is gone.
• Confirm the old key is dead: call the provider with it and expect an auth error. That, not the green scan, is the proof.
• Grep your build output (`.next/`, `dist/`) for the key prefix; it must not appear.

Limits (be straight about them)

muster-check matches key shapes; it won't find a key that has an unusual format or sits in a binary/ignored file.