security: strip hardcoded PGPASSWORD/pm2/shell-string secrets -> env-ref. No rotation/deploy.

d287f9d67963f09c002df15c80765674c47f5e76 · 2026-05-30 09:59:24 -0700 · Steve
Files touched

M DW-Agents/dw-agents/agent-legal-team/legal-agent.ts
M DW-Programming/ImportNewSkufromURL/ecosystem.config.js
M DW-Programming/ImportNewSkufromURL/scripts/auto-update-vendor-skills.ts
M DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-screenshot-debugger.ts
M DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-yolo-dangerous.ts
M DW-Programming/ImportNewSkufromURL/thibaut-spec-scraper.js
M scripts/import-fmpro-to-postgres.js
M shopify/scripts/dwvs-import-catalog-only.js
M shopify/scripts/dwvs-original-series-apply.js
M shopify/scripts/dwvs-reconcile-mfr.js
M shopify/scripts/sample-only-price-match.js
Diff

commit d287f9d67963f09c002df15c80765674c47f5e76
Author: Steve <steve@designerwallcoverings.com>
Date:   Sat May 30 09:59:24 2026 -0700

    security: strip hardcoded PGPASSWORD/pm2/shell-string secrets -> env-ref. No rotation/deploy.
---
 DW-Agents/dw-agents/agent-legal-team/legal-agent.ts                 | 6 +++---
 DW-Programming/ImportNewSkufromURL/ecosystem.config.js              | 2 +-
 .../ImportNewSkufromURL/scripts/auto-update-vendor-skills.ts        | 2 +-
 .../ImportNewSkufromURL/scripts/ralph-wiggum-screenshot-debugger.ts | 2 +-
 .../ImportNewSkufromURL/scripts/ralph-wiggum-yolo-dangerous.ts      | 2 +-
 DW-Programming/ImportNewSkufromURL/thibaut-spec-scraper.js          | 2 +-
 scripts/import-fmpro-to-postgres.js                                 | 2 +-
 shopify/scripts/dwvs-import-catalog-only.js                         | 2 +-
 shopify/scripts/dwvs-original-series-apply.js                       | 2 +-
 shopify/scripts/dwvs-reconcile-mfr.js                               | 2 +-
 shopify/scripts/sample-only-price-match.js                          | 2 +-
 11 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/DW-Agents/dw-agents/agent-legal-team/legal-agent.ts b/DW-Agents/dw-agents/agent-legal-team/legal-agent.ts
index c1519d90..fdc31ad1 100644
--- a/DW-Agents/dw-agents/agent-legal-team/legal-agent.ts
+++ b/DW-Agents/dw-agents/agent-legal-team/legal-agent.ts
@@ -60,7 +60,7 @@ const analysisCache = new Map<string, { compliant: boolean; analysis: string; ti
 function psqlQuery(sql: string): Promise<any[]> {
   return new Promise((resolve, reject) => {
     const escaped = sql.replace(/'/g, "'\\''");
-    exec(`PGPASSWORD=DW2024SecurePass psql -U dw_admin -h 127.0.0.1 -d dw_unified -t -A -F '|||' -c '${escaped}'`, { timeout: 15000 }, (err, stdout, stderr) => {
+    exec(`PGPASSWORD=${process.env.PGPASSWORD||''} psql -U dw_admin -h 127.0.0.1 -d dw_unified -t -A -F '|||' -c '${escaped}'`, { timeout: 15000 }, (err, stdout, stderr) => {
       if (err) { reject(new Error(stderr || err.message)); return; }
       const lines = stdout.trim().split('\n').filter(l => l.length > 0);
       resolve(lines);
@@ -72,7 +72,7 @@ function psqlQueryJSON(sql: string): Promise<any[]> {
   return new Promise((resolve, reject) => {
     const fullSql = `SELECT json_agg(t) FROM (${sql}) t`;
     const escaped = fullSql.replace(/'/g, "'\\''");
-    exec(`PGPASSWORD=DW2024SecurePass psql -U dw_admin -h 127.0.0.1 -d dw_unified -t -A -c '${escaped}'`, { timeout: 15000 }, (err, stdout, stderr) => {
+    exec(`PGPASSWORD=${process.env.PGPASSWORD||''} psql -U dw_admin -h 127.0.0.1 -d dw_unified -t -A -c '${escaped}'`, { timeout: 15000 }, (err, stdout, stderr) => {
       if (err) { reject(new Error(stderr || err.message)); return; }
       try {
         const result = JSON.parse(stdout.trim() || '[]');
@@ -85,7 +85,7 @@ function psqlQueryJSON(sql: string): Promise<any[]> {
 function psqlExec(sql: string): Promise<void> {
   return new Promise((resolve, reject) => {
     const escaped = sql.replace(/'/g, "'\\''");
-    exec(`PGPASSWORD=DW2024SecurePass psql -U dw_admin -h 127.0.0.1 -d dw_unified -c '${escaped}'`, { timeout: 15000 }, (err, stdout, stderr) => {
+    exec(`PGPASSWORD=${process.env.PGPASSWORD||''} psql -U dw_admin -h 127.0.0.1 -d dw_unified -c '${escaped}'`, { timeout: 15000 }, (err, stdout, stderr) => {
       if (err) { reject(new Error(stderr || err.message)); return; }
       resolve();
     });
diff --git a/DW-Programming/ImportNewSkufromURL/ecosystem.config.js b/DW-Programming/ImportNewSkufromURL/ecosystem.config.js
index abc17158..7595b5fd 100644
--- a/DW-Programming/ImportNewSkufromURL/ecosystem.config.js
+++ b/DW-Programming/ImportNewSkufromURL/ecosystem.config.js
@@ -13,7 +13,7 @@ module.exports = {
       POSTGRES_HOST: '45.61.58.125',
       POSTGRES_DATABASE: 'dw_unified',
       POSTGRES_USER: 'dw_admin',
-      POSTGRES_PASSWORD: 'DW2024SecurePass',
+      POSTGRES_PASSWORD: process.env.POSTGRES_PASSWORD || '',
       POSTGRES_PORT: '5432'
     }
   }]
diff --git a/DW-Programming/ImportNewSkufromURL/scripts/auto-update-vendor-skills.ts b/DW-Programming/ImportNewSkufromURL/scripts/auto-update-vendor-skills.ts
index c869bc2f..1d17e13e 100644
--- a/DW-Programming/ImportNewSkufromURL/scripts/auto-update-vendor-skills.ts
+++ b/DW-Programming/ImportNewSkufromURL/scripts/auto-update-vendor-skills.ts
@@ -255,7 +255,7 @@ export const ${vendorId.replace(/-/g, '_')}_skill: VendorSkill = {
           `;
           
           await execAsync(`
-            export PGPASSWORD='DW2024SecurePass' && 
+            export PGPASSWORD=${process.env.PGPASSWORD||''} && 
             psql -h localhost -U dw_admin -d dw_unified -c "${updateQuery}"
           `);
           
diff --git a/DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-screenshot-debugger.ts b/DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-screenshot-debugger.ts
index 3b1ba4fd..73888b25 100644
--- a/DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-screenshot-debugger.ts
+++ b/DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-screenshot-debugger.ts
@@ -265,7 +265,7 @@ class RalphWiggumScreenshotDebugger {
   private async loadVendors(): Promise<any[]> {
     try {
       const { stdout } = await execAsync(`
-        export PGPASSWORD='DW2024SecurePass' && 
+        export PGPASSWORD=${process.env.PGPASSWORD||''} && 
         psql -h localhost -U dw_admin -d dw_unified -t -A -c "
           SELECT json_agg(row_to_json(v)) 
           FROM (
diff --git a/DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-yolo-dangerous.ts b/DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-yolo-dangerous.ts
index bfc546a5..e57a0fdc 100755
--- a/DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-yolo-dangerous.ts
+++ b/DW-Programming/ImportNewSkufromURL/scripts/ralph-wiggum-yolo-dangerous.ts
@@ -393,7 +393,7 @@ class RalphWiggumYoloDangerous {
     try {
       // Try PostgreSQL first
       const { stdout } = await execAsync(`
-        export PGPASSWORD='DW2024SecurePass' && 
+        export PGPASSWORD=${process.env.PGPASSWORD||''} && 
         psql -h localhost -U dw_admin -d dw_unified -t -A -c "
           SELECT json_agg(row_to_json(v)) 
           FROM (
diff --git a/DW-Programming/ImportNewSkufromURL/thibaut-spec-scraper.js b/DW-Programming/ImportNewSkufromURL/thibaut-spec-scraper.js
index 6f232c43..7b913881 100644
--- a/DW-Programming/ImportNewSkufromURL/thibaut-spec-scraper.js
+++ b/DW-Programming/ImportNewSkufromURL/thibaut-spec-scraper.js
@@ -1,7 +1,7 @@
 const puppeteer = require('puppeteer');
 const { execSync } = require('child_process');
 
-const DB_CMD = 'PGPASSWORD=DW2024SecurePass psql -h 127.0.0.1 -U dw_admin -d dw_unified -t -A -c';
+const DB_CMD = 'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -t -A -c';
 
 function queryDB(sql) {
   try {
diff --git a/scripts/import-fmpro-to-postgres.js b/scripts/import-fmpro-to-postgres.js
index 52fd3491..ed1d7f5b 100644
--- a/scripts/import-fmpro-to-postgres.js
+++ b/scripts/import-fmpro-to-postgres.js
@@ -59,7 +59,7 @@ async function run() {
   console.log('\n📥 Bulk inserting via COPY...');
   await pool.query('TRUNCATE TABLE dw_mfr_crossref RESTART IDENTITY');
 
-  execSync(`PGPASSWORD='DW2024SecurePass' psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "\\COPY dw_mfr_crossref(dw_sku, dw_sku_dash, mfr_sku, vendor_code, vendor_name) FROM '${TEMP_CSV}' WITH (FORMAT csv, HEADER true)"`);
+  execSync(`PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "\\COPY dw_mfr_crossref(dw_sku, dw_sku_dash, mfr_sku, vendor_code, vendor_name) FROM '${TEMP_CSV}' WITH (FORMAT csv, HEADER true)"`);
 
   const countResult = await pool.query('SELECT COUNT(*) as cnt FROM dw_mfr_crossref');
   console.log(`   ✅ Inserted ${countResult.rows[0].cnt} records`);
diff --git a/shopify/scripts/dwvs-import-catalog-only.js b/shopify/scripts/dwvs-import-catalog-only.js
index 155e5f20..2b76b50e 100644
--- a/shopify/scripts/dwvs-import-catalog-only.js
+++ b/shopify/scripts/dwvs-import-catalog-only.js
@@ -25,7 +25,7 @@ function runSQL(sql) {
   const tmp = `/tmp/dwvs-sql-${Date.now()}.sql`;
   fs.writeFileSync(tmp, sql);
   execSync(`scp -q ${tmp} root@45.61.58.125:${tmp}`);
-  const out = execSync(`ssh root@45.61.58.125 "PGPASSWORD=DW2024SecurePass psql -h 127.0.0.1 -U dw_admin -d dw_unified -A -F $'\\t' -f ${tmp}"`).toString();
+  const out = execSync(`ssh root@45.61.58.125 "PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -A -F $'\\t' -f ${tmp}"`).toString();
   execSync(`ssh root@45.61.58.125 "rm -f ${tmp}"`);
   fs.unlinkSync(tmp);
   return out;
diff --git a/shopify/scripts/dwvs-original-series-apply.js b/shopify/scripts/dwvs-original-series-apply.js
index 081d6b94..20a2a417 100644
--- a/shopify/scripts/dwvs-original-series-apply.js
+++ b/shopify/scripts/dwvs-original-series-apply.js
@@ -31,7 +31,7 @@ function runSQL(sql) {
   const tmp = `/tmp/vsql-${Date.now()}.sql`;
   fs.writeFileSync(tmp, sql);
   execSync(`scp -q ${tmp} root@45.61.58.125:${tmp}`);
-  const out = execSync(`ssh root@45.61.58.125 "PGPASSWORD=DW2024SecurePass psql -h 127.0.0.1 -U dw_admin -d dw_unified -A -F $'\\t' -f ${tmp}"`).toString();
+  const out = execSync(`ssh root@45.61.58.125 "PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -A -F $'\\t' -f ${tmp}"`).toString();
   execSync(`ssh root@45.61.58.125 "rm -f ${tmp}"`);
   fs.unlinkSync(tmp);
   return out;
diff --git a/shopify/scripts/dwvs-reconcile-mfr.js b/shopify/scripts/dwvs-reconcile-mfr.js
index 2ff0cad4..3f2c010e 100644
--- a/shopify/scripts/dwvs-reconcile-mfr.js
+++ b/shopify/scripts/dwvs-reconcile-mfr.js
@@ -35,7 +35,7 @@ function runSQL(sql) {
   const tmp = `/tmp/dwvs-sql-${Date.now()}.sql`;
   fs.writeFileSync(tmp, sql);
   execSync(`scp -q ${tmp} root@45.61.58.125:${tmp}`);
-  const out = execSync(`ssh root@45.61.58.125 "PGPASSWORD=DW2024SecurePass psql -h 127.0.0.1 -U dw_admin -d dw_unified -A -F $'\\t' -f ${tmp}"`).toString();
+  const out = execSync(`ssh root@45.61.58.125 "PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -A -F $'\\t' -f ${tmp}"`).toString();
   execSync(`ssh root@45.61.58.125 "rm -f ${tmp}"`);
   fs.unlinkSync(tmp);
   return out;
diff --git a/shopify/scripts/sample-only-price-match.js b/shopify/scripts/sample-only-price-match.js
index d90c2dd7..f7dce3fe 100644
--- a/shopify/scripts/sample-only-price-match.js
+++ b/shopify/scripts/sample-only-price-match.js
@@ -94,6 +94,6 @@ const Q = `query($ids: [ID!]!) {
   `;
   fs.writeFileSync('/tmp/match-sql.sql', sql);
   execSync('scp -q /tmp/match-sql.sql root@45.61.58.125:/tmp/match-sql.sql');
-  const out = execSync(`ssh root@45.61.58.125 "PGPASSWORD=DW2024SecurePass psql -h 127.0.0.1 -U dw_admin -d dw_unified -f /tmp/match-sql.sql"`).toString();
+  const out = execSync(`ssh root@45.61.58.125 "PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -f /tmp/match-sql.sql"`).toString();
   console.log(out);
 })();
← b3de17d1 security: strip hardcoded dw_admin DSN password -> env-first · back to Designer Wallcoverings · fix: thibaut-spec-scraper DB_CMD backtick (env interpolation f1421f70 →