Launch a Token guide uses raw PRIVATE_KEY env variable, contradicting Deploy Smart Contracts guide's safer keystore approach
- Dominant language
- JavaScript
- Stars
- 337
- Forks
- 792
- Avg merge
- 17h 23m
- Merged PRs (30d)
- 49
Description
## Description
The "Launch a Token" guide uses `vm.envUint("PRIVATE_KEY")` to load a
private key directly from a `.env` file in the deployment script.
However, the "Deploy Smart Contracts" guide on the same site explicitly
teaches `cast wallet import deployer --interactive` as the secure approach,
with a warning: "Never share or commit your private key."
These two pages give contradictory advice on a security-critical topic
with no explanation of the difference.
## Pages affected
- https://docs.base.org/get-started/launch-token (uses raw env var)
- https://docs.base.org/get-started/deploy-smart-contracts (uses keystore)
## Suggested fix
Either align both guides to use the keystore method, or add a note on the
Launch a Token page explaining when a raw PRIVATE_KEY env var is acceptable
(e.g. only in CI/CD pipelines, never locally) and link to the safer approach.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.