security: rotate exposed payment credentials and purge them from repository history

[teesofttech]

Why

Tracked application settings contain live-looking payment credentials in a public repository. Assume every committed value has been compromised. Do not paste credential values into this issue or comments.

Scope

• Inventory secrets in current files, tags, releases, package artifacts, and git history.
• Revoke and rotate affected provider credentials immediately.
• Replace committed values with placeholders and load local secrets from user-secrets or environment variables.
• Purge leaked values from history where practical and invalidate old package/release artifacts if they contain them.
• Add automated secret scanning and a documented response procedure.

Acceptance criteria

• Every exposed credential is confirmed revoked and replaced.
• No live/test merchant credential remains in tracked files or package artifacts.
• GitHub secret scanning / push protection or an equivalent CI control is enabled.
• The sample applications start with placeholders and fail safely with clear setup instructions.
• Rotation actions are recorded privately; no secret values are added to this public issue.