`CHANGES.md`

26 lines

## Applied
- admin/server.ts:19 — replaced `ADMIN_PASSWORD` fallback with required env lookup and fail-fast error — removes hardcoded default admin credential.
- admin/server.ts:427 — stopped printing the configured admin password at startup — prevents runtime secret disclosure in logs.
- brand-router/server.js:11 — replaced hardcoded Shopify token with `BRAND_ROUTER_SHOPIFY_TOKEN` and fail-fast check — removes exposed token from source.
- brand-router/server.js:13 — replaced hardcoded Gemini key with `BRAND_ROUTER_GEMINI_API_KEY` and fail-fast check — removes exposed API key from source.
- brand-router/server.js:14 — replaced hardcoded basic-auth password with `BRAND_ROUTER_PASSWORD` and fail-fast check — removes exposed admin password from source.
- DW-Websites/shop-by-color/server.js:9 — replaced hardcoded Shopify token with `SHOP_BY_COLOR_SHOPIFY_TOKEN` and fail-fast check — removes exposed token from source.
- DW-Agents/dw-agents/in-parallel-agent.ts:611 — moved `message` extraction before use and added a 400 guard for missing/invalid body — prevents a request-body crash.
- .env.example:12 — added placeholder env vars for the updated admin, brand-router, and shop-by-color settings — documents required secrets without storing real values.

## Deferred (needs Steve)
- P0 — DW-Agents/ecosystem.config.js:45 — hardcoded production-looking secrets — PM2 ecosystem files are explicitly out of scope; rotate real credentials.
- P0 — .env:1 — live secret-bearing env files in project tree — `.env` files were left untouched; confirm tracking/backups and rotate externally.
- P0 — shopify/.env:1 — live secret-bearing env file — `shopify/` is explicitly out of scope; confirm tracking/backups and rotate externally.
- P0 — DW-MCP/.env:1 — live secret-bearing env file — `.env` files were left untouched; confirm tracking/backups and rotate externally.
- P0 — DW-Agents/.env:1 — live secret-bearing env file — `.env` files were left untouched; confirm tracking/backups and rotate externally.
- P0 — DW-Agents/dw-agents/agent-legal-team/legal-agent.ts:248 — missing auth before destructive/Claude routes — auth design and Shopify HMAC validation are beyond the safe list.
- P0 — admin/server.ts:30 — wildcard CORS and weak token generation remain — not included in the approved safe-fix list.
- P0 — DW-MCP/src/index.js:300 — OAuth callback lacks state validation and exposes generated token — auth flow changes are beyond the safe list.
- P0 — DW-Agents/dw-agents/agent-slack/slack-agent.ts:275 — Slack events are not signature-verified — webhook auth change is beyond the safe list.
- P0 — DW-MCP/src/index.js:369 — Shopify order webhook HMAC is not verified — webhook auth change is beyond the safe list.
- P1 — admin/server.ts:362 — failed-products query ignores `sessionId` — database behavior change was deferred because it is outside the safe list.
- P1 — brand-router/server.js:158 — GraphQL query interpolates user input — not one of the approved safe fixes.
- P1 — DW-MCP/monitor-new-orders.js:14 — polling/state ordering can skip or duplicate notifications — requires behavior redesign, not a surgical safe fix.
- P1 — brand-router/server.js:35 — synchronous brand-data read/write can block or race — datastore/concurrency change was deferred.