Inventory and store all personal-website credentials in 1Password

Priority: High

Problem

Credentials and recovery information required to operate the personal website should have one secure, authoritative home. The current setup needs an explicit credential inventory and migration to 1Password so access is not dependent on memory, browser state, local files, or scattered notes.

Goal

Create a complete operational credential inventory for mantoshkumar1.github.io and store every required secret/recovery item securely in 1Password without committing secrets to Git.

Scope

Inventory credentials and recovery material for all services used by the website, including where applicable:

• GitHub / GitHub Pages
• Cloudflare account and Worker-related access
• Buttondown
• domain/DNS provider if a custom domain is introduced
• AI/provider credentials or Cloudflare bindings used by Ask Mantosh
• deployment/recovery tokens not replaced by OIDC
• any email/account recovery information needed to regain administrative access

For each item, record the service, purpose, account identity, recovery path, and whether the secret is active, obsolete, or replaceable by short-lived/OIDC authentication.

Security requirements

• Never place actual secret values in the repository, GitHub issues, documentation, chat transcripts, screenshots, or test fixtures.
• Prefer eliminating long-lived secrets where OIDC or another short-lived mechanism already exists.
• Rotate any credential discovered in an unsafe location.

Acceptance criteria

• Every service required to operate, deploy, recover, and administer the website is represented in the credential inventory.
• All required secret values/recovery material are stored in 1Password.
• No secret values are committed to the repository or copied into issue comments/docs.
• Obsolete credentials are revoked or clearly marked obsolete.
• Long-lived credentials that can be replaced by short-lived/OIDC mechanisms are removed where practical.
• A secret-free operational document tells future operators which 1Password item/service to use without revealing credentials.

Start by enumerating the services listed in the Scope section and identify the account, recovery path, and credential status for each. Use the acceptance criteria as the completion checklist: store required recovery material in 1Password, remove or revoke obsolete and replaceable credentials, and produce a secret-free operational document without exposing values.