base / base/docs

Launch a Token guide uses raw PRIVATE_KEY env variable, contradicting Deploy Smart Contracts guide's safer keystore approach

Open
#1,357 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
337
Forks
792
Avg merge
17h 23m
Merged PRs (30d)
49

Description

## Description
The "Launch a Token" guide uses `vm.envUint("PRIVATE_KEY")` to load a
private key directly from a `.env` file in the deployment script.

However, the "Deploy Smart Contracts" guide on the same site explicitly
teaches `cast wallet import deployer --interactive` as the secure approach,
with a warning: "Never share or commit your private key."

These two pages give contradictory advice on a security-critical topic
with no explanation of the difference.

## Pages affected
- https://docs.base.org/get-started/launch-token (uses raw env var)
- https://docs.base.org/get-started/deploy-smart-contracts (uses keystore)

## Suggested fix
Either align both guides to use the keystore method, or add a note on the
Launch a Token page explaining when a raw PRIVATE_KEY env var is acceptable
(e.g. only in CI/CD pipelines, never locally) and link to the safer approach.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.