.env.production is committed in this public repo and carried three real per-mailbox SMTP passwords in plaintext — MAIL_PASSWORD_CHRIS, MAIL_PASSWORD_BLAKE, MAIL_PASSWORD_GLENN — readable at HEAD via the raw contents API.
They are not this app's credentials. They came from the stacksjs/stacks scaffold, which ships the same file to every buddy new app. Upstream fix: stacksjs/stacks#2211.
Removing them here does not un-publish them — the passwords need rotating at the mail provider. This stops them being served at HEAD.
No other secret in this file is exposed: everything else is non-secret config or an empty value.