Record Gemini key hygiene progress: 4/6 files env-ified, 2 held, revoke still Steve-only

6e0add2eeb1dbcc9861506a73e96cc95267f21ea · 2026-06-23 17:03:42 -0700 · Steve

Files touched

M pending-approval/gemini-key-rotation.md

Diff

commit 6e0add2eeb1dbcc9861506a73e96cc95267f21ea
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Jun 23 17:03:42 2026 -0700

    Record Gemini key hygiene progress: 4/6 files env-ified, 2 held, revoke still Steve-only
---
 pending-approval/gemini-key-rotation.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/pending-approval/gemini-key-rotation.md b/pending-approval/gemini-key-rotation.md
index 74b290fb..1d69b602 100644
--- a/pending-approval/gemini-key-rotation.md
+++ b/pending-approval/gemini-key-rotation.md
@@ -78,3 +78,28 @@ purge: `git filter-repo --replace-text <(echo 'AIza…ejMo==>REDACTED')` per rep
 - [ ] Approve (or decline) git-history rewrite + whether any force-push is allowed
 
 **$ cost:** $0 (local scans + edits). Gemini verify-endpoint call on import ≈ $0 (free tier ping).
+
+---
+
+## PROGRESS 2026-06-23 (autonomous, Steve-approved "do for me")
+
+**Env-ified 4 of 6 leaked-literal consumers** (literal removed from tracked source,
+now read env with throw-guard; all were NOT running → zero breakage):
+- ✅ DW vendor-command-center: logo-cropper.js, website-scorer.js, standardization-worker.js → master GEMINI_API_KEY (…-mvA, verified 200/50-models). Commit `a2407cfe`.
+- ✅ goodquestion-ai/scripts/generate-hero-images.cjs → process.env. Commit `253311e` (goodquestion-ai repo).
+
+**HELD 2 (need judgment/Steve — not safe to env-ify blind):**
+- ⏸ goodquestion-ai/scripts/sensitive_patterns.py:232 — the `…ejMo` literal is a
+  **secret-DETECTION test fixture** (tuple in a file named sensitive_patterns.py).
+  Env-ifying breaks the test's purpose. Decide: scrub the real key from the fixture
+  (replace with a fake `AIzaFAKE…` example) vs leave. Recommend replacing with a
+  clearly-fake placeholder so no real key sits in test data.
+- ⏸ dw-boardroom-v2/ecosystem.config.cjs:11 — `GEMINI_KEY` literal injected into a
+  **LIVE pm2 boardroom service** (running). Env-ifying risks breaking it on next
+  restart unless GEMINI_API_KEY is in the pm2 launch env first. Needs the boardroom
+  owner to confirm the launch env, then swap.
+
+**STILL THE ONLY REAL SECURITY FIX — Steve only:**
+- 🔴 Revoke `…ejMo` + `…S2ic` at Google AI Studio + issue fresh key. **Both keys are
+  still LIVE/compromised** until you do — env-ify is hygiene, not the fix.
+- 🔴 git-history scrub (destructive) — old keys remain in history on all repos.

← 407a1762 auto-save: 2026-06-23T16:53:06 (9 files) — shopify/scripts/c · back to Designer Wallcoverings · Backfill dw_unified mirror metafields from live Shopify for 0070a06b →