`CHANGES.md`

22 lines

## Applied
- `src/lib/auth.js:4` — added required env lookup; `JWT_SECRET` and `ADMIN_PASSWORD` now fail fast when missing — removes hardcoded JWT/admin secrets from source.
- `src/lib/db.js:3` — added required env lookup and changed the Postgres connection to `DATABASE_URL` — removes the hardcoded DB password from source.
- `react-dash/server.js:15` — added required env lookup; auth password and DB URL now come from `ADMIN_PASSWORD` and `DATABASE_URL` — removes exposed credentials from source.
- `kalshi-dash/server.js:17` — added required env lookup; auth password, Gemini key, main DB URL, and Ken DB URL now come from env — removes exposed credentials from source.
- `kalshi-dash/server.js:33` — changed Slack webhook to optional `SLACK_WEBHOOK_URL` — removes leaked webhook from source while preserving disabled Slack behavior.
- `kalshi-dash/server.js:3554` — removed browser-embedded Basic Auth credentials and switched API calls to same-origin credentials — prevents exposing the admin password to clients.
- `.env.example:1` — added placeholder-only env variables — documents required config without writing real secrets.

## Deferred (needs Steve)
- `P0` — `src/lib/auth.js:4`, `src/lib/auth.js:14`, `src/lib/db.js:12`, `kalshi-dash/server.js:33`, `kalshi-dash/server.js:138`, `kalshi-dash/server.js:359`, `kalshi-dash/server.js:4882` — exposed secrets must be revoked/rotated — rotation requires owner/provider access.
- `P0` — `src/app/api/markets/route.js:7`, `src/app/api/risk/route.js:7`, `src/app/api/trades/route.js:7`, `src/app/api/workers/route.js:5` — API routes lack server-side auth — broader auth behavior change, not in safe autonomous list.
- `P0` — `src/app/api/trades/route.js:25` — paper order validation and transaction safety missing — trading/business logic change, not safe without tests and owner review.
- `P0` — `react-dash/server.js:66`, `kalshi-dash/server.js:400` — unsigned forgeable session cookies — replacing session design is outside the allowed safe fixes.
- `P0` — `react-dash/server.js:152`, `kalshi-dash/server.js:589` — Google OAuth fails open when `ALLOWED_EMAILS` is unset — access policy change needs Steve confirmation.
- `P1` — `src/app/api/trades/route.js:47` — bankroll updates can race — requires transaction/locking design, not a safe patch.
- `P1` — `src/workers/cron-runner.js:24` — cron jobs can overlap — scheduler/locking behavior needs design confirmation.
- `P1` — `src/app/api/markets/route.js:79` — ingest errors are hidden behind success — API contract change deferred.
- `P1` — `react-dash/server.js:43` — wildcard CORS on authenticated API — deployment origin policy needed.
- `P1` — `src/lib/risk.js:16` — dynamic SQL columns are not whitelisted — internal API hardening deferred because not in safe list.
- `P1` — `next.config.js:3` — strict mode disabled and ESLint ignored — build policy change deferred.