diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..d3b3180
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,13 @@
+# Firebase Configuration
+# Get these values from Firebase Console: https://console.firebase.google.com/
+VITE_FIREBASE_API_KEY=your_firebase_api_key
+VITE_FIREBASE_AUTH_DOMAIN=your-project.firebaseapp.com
+VITE_FIREBASE_PROJECT_ID=your-project-id
+VITE_FIREBASE_STORAGE_BUCKET=your-project.appspot.com
+VITE_FIREBASE_MESSAGING_SENDER_ID=your_messaging_sender_id
+VITE_FIREBASE_APP_ID=your_app_id
+
+# GitHub Actions Secrets (set these in repository settings)
+# NETLIFY_AUTH_TOKEN - Netlify authentication token
+# NETLIFY_SITE_ID - Netlify site ID
+# OPENCODE_API_KEY - OpenCode API key for AI coding agent
diff --git a/.github/workflows/netlify-deploy.yml b/.github/workflows/netlify-deploy.yml
index 5729360..8d73508 100644
--- a/.github/workflows/netlify-deploy.yml
+++ b/.github/workflows/netlify-deploy.yml
@@ -42,8 +42,8 @@ jobs:
           enable-commit-comment: false
           overwrites-pull-request-comment: false
         env:
-          NETLIFY_AUTH_TOKEN: nfp_7mrwfjfXpwtAA2yRS9Cdj52S5GLWuB8v6393
-          NETLIFY_SITE_ID: ef61ba0a-53d3-45ed-8965-4fcd861654ba
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
         timeout-minutes: 1
 
       - name: Create Deployment Status
diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
index d6beec3..bd8d2be 100644
--- a/.github/workflows/opencode.yml
+++ b/.github/workflows/opencode.yml
@@ -26,6 +26,6 @@ jobs:
       - name: Run opencode
         uses: sst/opencode/github@latest
         env:
-          OPENCODE_API_KEY: sk-XyMEqVpNCa0YtYDE3u9MLlNvO5R28tbHaM2J629rzDE5LZnjhweCR4M20dbMKbcX
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
         with:
           model: opencode/grok-code
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index a547bf3..556cd6e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,11 @@ dist
 dist-ssr
 *.local
 
+# Environment variables
+.env
+.env.local
+.env.*.local
+
 # Editor directories and files
 .vscode/*
 !.vscode/extensions.json
diff --git a/README.md b/README.md
index 32e8b42..68d6839 100644
--- a/README.md
+++ b/README.md
@@ -82,20 +82,29 @@ Open `http://localhost:3000` and sign in with GitHub.
 
 ## Setup
 
+### Environment Variables
+
+1. Copy the example environment file:
+```bash
+cp .env.example .env
+```
+
+2. Fill in your Firebase configuration in `.env`:
+```env
+VITE_FIREBASE_API_KEY=your_firebase_api_key
+VITE_FIREBASE_AUTH_DOMAIN=your-project.firebaseapp.com
+VITE_FIREBASE_PROJECT_ID=your-project-id
+VITE_FIREBASE_STORAGE_BUCKET=your-project.appspot.com
+VITE_FIREBASE_MESSAGING_SENDER_ID=your_messaging_sender_id
+VITE_FIREBASE_APP_ID=your_app_id
+```
+
 ### Firebase Configuration
 
 1. Create a project at [Firebase Console](https://console.firebase.google.com/)
 2. Enable GitHub authentication under **Authentication > Sign-in method**
-3. Update `services/firebaseService.ts` with your config:
-
-```typescript
-const firebaseConfig = {
-  apiKey: "YOUR_API_KEY",
-  authDomain: "YOUR_PROJECT.firebaseapp.com",
-  projectId: "YOUR_PROJECT_ID",
-  // ... rest of config
-};
-```
+3. Get your Firebase config from **Project Settings > General > Your apps**
+4. Add the values to your `.env` file (see above)
 
 ### GitHub OAuth
 
@@ -103,6 +112,14 @@ const firebaseConfig = {
 2. Create an **OAuth App** with callback: `https://YOUR_PROJECT.firebaseapp.com/__/auth/handler`
 3. Add Client ID and Secret to Firebase GitHub provider settings
 
+### GitHub Actions Secrets (for deployment)
+
+If you plan to deploy this app, configure these secrets in your GitHub repository settings (**Settings > Secrets and variables > Actions**):
+
+- `NETLIFY_AUTH_TOKEN` - Your Netlify authentication token
+- `NETLIFY_SITE_ID` - Your Netlify site ID
+- `OPENCODE_API_KEY` - Your OpenCode API key (if using OpenCode agent)
+
 ## How Agent Integration Works
 
 ### Creating Agent-Ready Issues
diff --git a/services/firebaseService.ts b/services/firebaseService.ts
index efb55d8..532cec4 100644
--- a/services/firebaseService.ts
+++ b/services/firebaseService.ts
@@ -12,12 +12,12 @@ import {
 } from 'firebase/auth';
 
 const firebaseConfig = {
-  apiKey: "AIzaSyAf0CIHBZ-wEQJ8CCUUWo1Wl9P7typ_ZPI",
-  authDomain: "gptcall-416910.firebaseapp.com",
-  projectId: "gptcall-416910",
-  storageBucket: "gptcall-416910.appspot.com",
-  messagingSenderId: "99275526699",
-  appId: "1:99275526699:web:3b623e1e2996108b52106e"
+  apiKey: import.meta.env.VITE_FIREBASE_API_KEY || "AIzaSyAf0CIHBZ-wEQJ8CCUUWo1Wl9P7typ_ZPI",
+  authDomain: import.meta.env.VITE_FIREBASE_AUTH_DOMAIN || "gptcall-416910.firebaseapp.com",
+  projectId: import.meta.env.VITE_FIREBASE_PROJECT_ID || "gptcall-416910",
+  storageBucket: import.meta.env.VITE_FIREBASE_STORAGE_BUCKET || "gptcall-416910.appspot.com",
+  messagingSenderId: import.meta.env.VITE_FIREBASE_MESSAGING_SENDER_ID || "99275526699",
+  appId: import.meta.env.VITE_FIREBASE_APP_ID || "1:99275526699:web:3b623e1e2996108b52106e"
 };
 
 // Initialize Firebase
diff --git a/vite.config.ts b/vite.config.ts
index 1b4c54f..a4eecb9 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -11,6 +11,7 @@ export default defineConfig(({ mode }) => {
       },
       plugins: [react()],
       define: {
+        // Vite automatically exposes VITE_* env vars to import.meta.env
       },
       resolve: {
         alias: {