diff --git a/dev/config/base-config.yaml b/dev/config/base-config.yaml
index 58cc23919..0db18647c 100644
--- a/dev/config/base-config.yaml
+++ b/dev/config/base-config.yaml
@@ -14,13 +14,13 @@ ibex:
 
 bridge:
   enabled: true
-  apiKey: "sk-test-3bd6463c9cd77c3d8858c60b9997d0c6"
+  apiKey: "" # real key injected via config overrides; never commit a real key
   baseUrl: "https://api.sandbox.bridge.xyz/v0"
   minWithdrawalAmount: 2
   timeoutMs: 15000
   webhook:
     port: 4009
-    replaySecret: "also-not-so-secret"
+    replaySecret: "" # set BRIDGE_WEBHOOK_REPLAY_SECRET or a local override to enable /internal/replay
     publicKeys:
       kyc: |
         -----BEGIN PUBLIC KEY-----