Skip to content

fix(report): hardcode real Turnstile site key #403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
slaveofcode merged 1 commit into from
Sep 27, 2026
Merged

fix(report): hardcode real Turnstile site key #403

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions src/config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,10 @@ export const NOINDEX =
* Falls back to 'dev' for local/dev where it isn't set. Public, non-secret. */
export const BUILD_SHA = import.meta.env.PUBLIC_BUILD_SHA || 'dev';

/** Cloudflare Turnstile PUBLIC site key (not a secret). Defaults to Cloudflare's
* always-pass test key so self-host/staging work before a real key is set. */
export const TURNSTILE_SITE_KEY = import.meta.env.PUBLIC_TURNSTILE_SITE_KEY || '1x00000000000000000000AA';
/** Cloudflare Turnstile PUBLIC site key (not a secret — it renders in every
* visitor's page). Hardcoded as the default like GA_ID, because Cloudflare build
* vars have been dropped in prod before; the PUBLIC_ override still wins if set.
* The matching Secret Key lives in the TURNSTILE_SECRET Worker secret. Forks/
* self-host can override with PUBLIC_TURNSTILE_SITE_KEY (Cloudflare test key
* 1x00000000000000000000AA always passes). */
export const TURNSTILE_SITE_KEY = import.meta.env.PUBLIC_TURNSTILE_SITE_KEY || '0x4AAAAAAFE6EiMkO_xbnWQL';
Loading