From c9d9d57d810453c538a1c97d17471272e2eec085 Mon Sep 17 00:00:00 2001
From: magqqgq <146786427+magqqgq@users.noreply.github.com>
Date: Fri, 21 Aug 2026 23:40:39 +0300
Subject: [PATCH 1/4] Fix: Remove hardcoded engine-auth secrets and secure
 operator deployment paths

### Description
This PR eliminates hardcoded secrets and hardens the configuration management practices within the `node` repository.

**Vulnerabilities & Security Defects Remediated:**
* **Secrets and Configuration Management (`.env.mainnet`, `.env.sepolia`, `.gitignore`, `README.md`):** A live 64-character `engine-auth` credential was identified in the tracked deployment environments. This has been remediated by replacing the hardcoded secret with an explicit `REPLACE_WITH_A_64_CHARACTER_HEX_SECRET` placeholder. The `.gitignore` policy has been strengthened to ignore local configuration copies (`.env`, `.env.*`). The operator setup commands in `README.md` now correctly instruct users to define `BASE_NODE_L2_ENGINE_AUTH_RAW` only within untracked, local configuration files.
---
 README.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 2e0b629989..bc1b1dd313 100644
--- a/README.md
+++ b/README.md
@@ -13,10 +13,10 @@ Base is a secure, low-cost, developer-friendly Ethereum L2 built on Optimism's [
 ## Quick Start
 
 1. Ensure you have an Ethereum L1 full node RPC and beacon endpoint available.
-2. Choose your network:
-   - For mainnet: use `.env.mainnet`
-   - For testnet: use `.env.sepolia`
-3. Configure your L1 endpoints in the appropriate `.env` file:
+2. Copy the configuration file for your network to a local, ignored file:
+   - For mainnet: `cp .env.mainnet .env.local.mainnet`
+   - For testnet: `cp .env.sepolia .env.local.sepolia`
+3. Configure your L1 endpoints and `BASE_NODE_L2_ENGINE_AUTH_RAW` in the copied `.env` file:
    ```bash
    BASE_NODE_L1_ETH_RPC=<your-preferred-l1-rpc>
    BASE_NODE_L1_BEACON=<your-preferred-l1-beacon>
@@ -25,10 +25,10 @@ Base is a secure, low-cost, developer-friendly Ethereum L2 built on Optimism's [
 
    ```bash
    # For mainnet (default):
-   docker compose up --build
+   NETWORK_ENV=.env.local.mainnet docker compose up --build
 
    # For testnet:
-   NETWORK_ENV=.env.sepolia docker compose up --build
+   NETWORK_ENV=.env.local.sepolia docker compose up --build
    ```
 
 ## Supported Clients

From b2cb8ff0fc5d3cb0d4400431fb6df9c30ded1383 Mon Sep 17 00:00:00 2001
From: magqqgq <146786427+magqqgq@users.noreply.github.com>
Date: Fri, 21 Aug 2026 23:42:13 +0300
Subject: [PATCH 2/4] Update .env.sepolia

---
 .env.sepolia | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.env.sepolia b/.env.sepolia
index e518129fbd..cd781b38e7 100644
--- a/.env.sepolia
+++ b/.env.sepolia
@@ -21,7 +21,7 @@ BASE_NODE_L1_TRUST_RPC="false"
 # --------------------
 BASE_NODE_L2_ENGINE_RPC=http://execution:8551
 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
-BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
+BASE_NODE_L2_ENGINE_AUTH_RAW=REPLACE_WITH_A_64_CHARACTER_HEX_SECRET
 
 # P2P CONFIGURATION
 # -----------------

From 41f3937f0082309867484b02db8266ee3a9e6e92 Mon Sep 17 00:00:00 2001
From: magqqgq <146786427+magqqgq@users.noreply.github.com>
Date: Fri, 21 Aug 2026 23:42:25 +0300
Subject: [PATCH 3/4] Update .env.mainnet

---
 .env.mainnet | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.env.mainnet b/.env.mainnet
index ac9e52b665..af782037e3 100644
--- a/.env.mainnet
+++ b/.env.mainnet
@@ -21,7 +21,7 @@ BASE_NODE_L1_TRUST_RPC="false"
 # --------------------
 BASE_NODE_L2_ENGINE_RPC=ws://execution:8551
 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
-BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
+BASE_NODE_L2_ENGINE_AUTH_RAW=REPLACE_WITH_A_64_CHARACTER_HEX_SECRET
 
 # P2P CONFIGURATION
 # -----------------

From 47f5b1f6bbc34183254409e71a08a6b038ddc08e Mon Sep 17 00:00:00 2001
From: magqqgq <146786427+magqqgq@users.noreply.github.com>
Date: Fri, 21 Aug 2026 23:42:34 +0300
Subject: [PATCH 4/4] Update .gitignore

---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index 1dc513860f..d5c0c8fbf3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,6 @@
 /reth-data/
 /dependency_updater/dependency_updater
 .DS_Store
+# Local operator configuration files may contain credentials.
+.env
+.env.*