Set up this project so no password or API key can leak.
1. Create a file named .env in the project root for every key and password, one per line as NAME=value, and tell me which values you need from me.
2. Add .env to .gitignore so git never saves it, and check that it is not already in a past commit.
3. Change the code so it reads keys from .env instead of holding them in files.
4. Search every file for anything that looks like a key or password and list the file names, without printing the values.
5. Add a check that runs before every commit and blocks it when a file holds a key.