{"slug":"norma-sdcc-pitch","total":17,"limit":100,"offset":0,"since":null,"commits":[{"hash":"77b4310","date":"2026-07-27 20:05:44 -0700","author":"Steve Abrams","subject":"migrate GoDaddy auth → Bearer PAT (TK-10 key rotation); sso-key fallback retained","body":"Co-Authored-By: Claude Opus 4.8 (1M context) "},{"hash":"6628681","date":"2026-06-03 20:24:33 -0700","author":"SteveStudio2","subject":"gitignore: add missing standard excludes (tmp/ dist/ build/ .next/)","body":""},{"hash":"536b25a","date":"2026-05-31 16:56:04 -0700","author":"SteveStudio2","subject":"Link favicon.svg in head (use branded SVG, not .ico fallback)","body":""},{"hash":"e7cc6ea","date":"2026-05-31 16:32:36 -0700","author":"SteveStudio2","subject":"Add per-site favicon (kills /favicon.ico 404)","body":""},{"hash":"6be4a5a","date":"2026-05-21 19:02:47 -0700","author":"SteveStudio2","subject":"harden(auth): refuse to boot pitch deck in NODE_ENV=production when env passwords missing","body":"Was: prod boot with unset SDCC_PASSWORD/STEVE_PASSWORD silently fell back\nto hard-coded defaults (Pulse-2026 / DWSecure2024!) and logged a warning.\nThat's the worst kind of credential drift — nobody notices until it leaks.\n\nNow: in NODE_ENV=production, ALL configured passwords must be set as env\nvars. If any are missing, process.exit(2) with a stderr explanation of\nexactly which ones to set. Dev (NODE_ENV != production) is unchanged —\ndefaults still allowed for convenience, single warning per default used.\n\nVerified: prod (with env vars set) still boots clean + good-pw login\nworks. Negative test (env -i NODE_ENV=production node server.js) exits\nwith the refusal message + code 2."},{"hash":"88191f5","date":"2026-05-21 18:59:17 -0700","author":"SteveStudio2","subject":"fix(auth): replace plain-text password compare with scrypt + timingSafeEqual","body":"Was:\n if (LOGINS[u] && password === LOGINS[u]) ← plaintext compare, timing-leak\n\nNow:\n scrypt-hash env-var plaintexts at module load (N=16384, keylen=64,\n random per-user salt). Compare submitted password via scrypt + the same\n salt, then crypto.timingSafeEqual against the stored hash. Plaintexts\n are scrubbed from process.env immediately after hashing so they don't\n sit in /proc//environ for the life of the process.\n\nNo new deps — uses node built-in crypto.scryptSync. Defaults\n(Pulse-2026 / DWSecure2024!) preserved for dev convenience; a stderr\nwarning fires when NODE_ENV=production and the env var is unset.\n\nVerified live: 3 wrong-pw → 302 each, right-pw → 302 + Set-Cookie,\nprocess.env no longer contains SDCC_PASSWORD/STEVE_PASSWORD."},{"hash":"418a7c6","date":"2026-05-21 18:51:04 -0700","author":"SteveStudio2","subject":"feat(auth): rate-limit POST /login on norma-sdcc-pitch (10/15min per IP, 30min lockout)","body":"Public pitch deck at https://pitch.sdcc.agentabrams.com/login had zero\nrate-limit + plain-text password compare. The plain-text compare is a\nseparate concern flagged for follow-up; this commit only addresses the\nbrute-force vector.\n\nPattern matches Norma's rate-limit (lib/rate-limit.ts) but kept inline\nsince this project is single-file Express with no util layer:\n- in-memory Map keyed by IP (X-Forwarded-For aware — nginx in front)\n- 10 fails per 15-min window → 30-min lockout\n- success clears counter\n- 429 with Retry-After + a small HTML page when locked\n- Map auto-cleans stale entries every 5 min via setInterval().unref()"},{"hash":"c6eb87e","date":"2026-05-20 10:04:42 -0700","author":"SteveStudio2","subject":"add: dashboard modals — click priority cards / loop cards / cron cards opens detail modal with extended sections; +3 XP per modal opened; Vault section deployed with full token form","body":""},{"hash":"948a924","date":"2026-05-20 10:00:52 -0700","author":"SteveStudio2","subject":"add: section 11 Token Vault — 6 categories (AI / Email / Advocacy / Productivity / Data / Norma internals), 21 token slots, password-typed inputs with show/hide, last4 masking on read, delete + bulk save","body":""},{"hash":"51ce968","date":"2026-05-20 09:29:32 -0700","author":"SteveStudio2","subject":"add: browser-playable explainer video banner at top of pitch viewer — Steve's cloned voice, HTML5