Seguridad

# .env (NUNCA commitear)
PAN_API_KEY=pan_sk_tu_api_key_aqui

# Siempre ignorar
.env
.env.local
.env.*.local
.env.production

// config/pan.js
const config = {
  development: {
    apiKey: process.env.PAN_API_KEY_DEV,
    baseURL: 'https://api-staging.pan.tech/v1'
  },
  staging: {
    apiKey: process.env.PAN_API_KEY_STAGING,
    baseURL: 'https://api-staging.pan.tech/v1'
  },
  production: {
    apiKey: process.env.PAN_API_KEY_PROD,
    baseURL: 'https://api.pan.tech/v1'
  }
};

export default config[process.env.NODE_ENV || 'development'];

# .github/workflows/deploy.yml
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Deploy
        env:
          PAN_API_KEY: ${{ secrets.PAN_API_KEY }}
        run: npm run deploy

vercel secrets add pan_api_key pan_sk_...

# NO incluir secrets en Dockerfile
# Usar en runtime:
docker run -e PAN_API_KEY=$PAN_API_KEY myapp

// Script de verificación post-rotación
async function verificarKey() {
  try {
    const yields = await pan.yields.getAll();
    console.log('Nueva key funciona correctamente');
    return true;
  } catch (error) {
    console.error('Error con nueva key:', error.message);
    return false;
  }
}

┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│    Frontend      │ --> │    Tu Backend    │ --> │    pan API       │
│ (sin API key)    │     │ (con API key)    │     │                  │
└──────────────────┘     └──────────────────┘     └──────────────────┘

// app/api/wallet/route.ts (server-side)
import { Pan } from '@pan/sdk';

const pan = new Pan({ apiKey: process.env.PAN_API_KEY! });

export async function POST(request: Request) {
  const { userId } = await request.json();

  // Verificar autenticación del usuario aqui

  const wallet = await pan.wallet.create({ userId });
  return Response.json(wallet);
}

// Frontend - NO tiene acceso a la API key
async function createWallet(userId: string) {
  const response = await fetch('/api/wallet', {
    method: 'POST',
    body: JSON.stringify({ userId })
  });
  return response.json();
}

import { z } from 'zod';

const createWalletSchema = z.object({
  userId: z.string().min(1).max(100),
  email: z.string().email().optional(),
  metadata: z.record(z.string()).optional()
});

async function createWallet(data: unknown) {
  const validated = createWalletSchema.parse(data);
  return await pan.wallet.create(validated);
}

// MAL
console.log('Request:', { apiKey, userId, amount });

// BIEN
console.log('Request:', { userId, amount });

// Helper para logging seguro
function sanitizeLog(obj: object): object {
  const sensitiveKeys = ['apiKey', 'password', 'token', 'secret'];

  return Object.fromEntries(
    Object.entries(obj).map(([key, value]) => [
      key,
      sensitiveKeys.includes(key) ? '[REDACTED]' : value
    ])
  );
}

// Alerta de uso alto
async function checkUsage() {
  const usage = await fetch('https://api.pan.tech/dashboard/usage', {
    headers: { Authorization: `Bearer ${API_KEY}` }
  });

  const data = await usage.json();

  if (data.requestsToday > 1000) {
    sendAlert('Uso alto de API detectado');
  }
}