[object Object]

← back to Designer Wallcoverings

Env-ify 3 DW vendor-command-center files: remove leaked Gemini literal, use master key

b91b417b619f3c404838c0fd532ed9d4b90c0318 · 2026-06-23 16:48:49 -0700 · Steve

Removed the hardcoded leaked Gemini key (…ejMo) from logo-cropper.js,
website-scorer.js, standardization-worker.js — now read process.env.GEMINI_API_KEY
(the clean master …-mvA, verified 200/50-models) with a throw-guard. Scripts were
not running (zero breakage risk). This RETIRES the leaked key from DW scripts and
removes the literal from tracked source. NOTE: does NOT complete rotation — the
leaked key is still LIVE at Google until Steve revokes it, and remains in git
history (scrub is a separate destructive step).

Files touched

Diff

commit b91b417b619f3c404838c0fd532ed9d4b90c0318
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Jun 23 16:48:49 2026 -0700

    Env-ify 3 DW vendor-command-center files: remove leaked Gemini literal, use master key
    
    Removed the hardcoded leaked Gemini key (…ejMo) from logo-cropper.js,
    website-scorer.js, standardization-worker.js — now read process.env.GEMINI_API_KEY
    (the clean master …-mvA, verified 200/50-models) with a throw-guard. Scripts were
    not running (zero breakage risk). This RETIRES the leaked key from DW scripts and
    removes the literal from tracked source. NOTE: does NOT complete rotation — the
    leaked key is still LIVE at Google until Steve revokes it, and remains in git
    history (scrub is a separate destructive step).
---
 DW-Agents/vendor-command-center/logo-cropper.js           | 3 ++-
 DW-Agents/vendor-command-center/standardization-worker.js | 3 ++-
 DW-Agents/vendor-command-center/website-scorer.js         | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/DW-Agents/vendor-command-center/logo-cropper.js b/DW-Agents/vendor-command-center/logo-cropper.js
index b6ddf3c4..2dd63e18 100644
--- a/DW-Agents/vendor-command-center/logo-cropper.js
+++ b/DW-Agents/vendor-command-center/logo-cropper.js
@@ -8,7 +8,8 @@ const sharp = require('sharp');
 const fs = require('fs');
 const path = require('path');
 
-const GEMINI_KEY = 'REDACTED_GEMINI_KEY';
+const GEMINI_KEY = process.env.GEMINI_API_KEY || process.env.GEMINI_KEY;
+if (!GEMINI_KEY) throw new Error('GEMINI_KEY not set — route via /secrets (master GEMINI_API_KEY)');
 const GEMINI_URL = `https://generativelanguage.googleapis.com/v1beta/models/gemini-3.5-flash:generateContent?key=${GEMINI_KEY}`;
 
 /**
diff --git a/DW-Agents/vendor-command-center/standardization-worker.js b/DW-Agents/vendor-command-center/standardization-worker.js
index dfb0e2c6..ee0cf838 100644
--- a/DW-Agents/vendor-command-center/standardization-worker.js
+++ b/DW-Agents/vendor-command-center/standardization-worker.js
@@ -16,7 +16,8 @@ const pool = new Pool({
 
 const SHOPIFY_DOMAIN = 'designer-laboratory-sandbox.myshopify.com';
 const SHOPIFY_TOKEN = process.env.SHOPIFY_ORDERS_TOKEN;
-const GEMINI_API_KEY = 'REDACTED_GEMINI_KEY';
+const GEMINI_API_KEY = process.env.GEMINI_API_KEY || process.env.GEMINI_KEY;
+if (!GEMINI_API_KEY) throw new Error('GEMINI_API_KEY not set — route via /secrets (master GEMINI_API_KEY)');
 const GEMINI_URL = `https://generativelanguage.googleapis.com/v1beta/models/gemini-3.5-flash:generateContent?key=${GEMINI_API_KEY}`;
 
 // --- State ---
diff --git a/DW-Agents/vendor-command-center/website-scorer.js b/DW-Agents/vendor-command-center/website-scorer.js
index 298b4fa7..19e4ebd0 100644
--- a/DW-Agents/vendor-command-center/website-scorer.js
+++ b/DW-Agents/vendor-command-center/website-scorer.js
@@ -18,7 +18,8 @@ const https = require('https');
 const http = require('http');
 const { URL } = require('url');
 
-const GEMINI_KEY = 'REDACTED_GEMINI_KEY';
+const GEMINI_KEY = process.env.GEMINI_API_KEY || process.env.GEMINI_KEY;
+if (!GEMINI_KEY) throw new Error('GEMINI_KEY not set — route via /secrets (master GEMINI_API_KEY)');
 const GEMINI_MODEL = 'gemini-3.5-flash';
 const GEMINI_URL = `https://generativelanguage.googleapis.com/v1beta/models/${GEMINI_MODEL}:generateContent?key=${GEMINI_KEY}`;

← c1f4f758 Recommendations: 3-up+text on mobile, 4-up image-only on des  ·  back to Designer Wallcoverings  ·  Add gated publish-5.1-to-live script (Steve runs to swap liv fff4983c →