`CHANGES.md`

23 lines
## Applied
- `.env.example:1` — added placeholder-only env keys for Gemini, auth, admin scan, database, Ralph, and Shopify — documents required configuration without real secrets.
- `lib/auth.ts:8` — replaced hardcoded auth/session fallbacks with required env lookup — removes fallback credentials from source.
- `lib/gemini-image.ts:7`, `app/api/prd/generate/route.ts:8`, `app/api/prd/clarify/route.ts:4`, `app/api/ralph/convert/route.ts:6`, `app/api/claude/suggest/route.ts:6`, `app/api/url-info/route.ts:4`, `app/api/processes/analyze/route.ts:6`, `app/api/processes/fix/route.ts:7` — replaced Gemini key fallbacks with fail-fast env checks — removes live API key from app source.
- `scripts/ralph-llm-runner.js:45` — removed Gemini fallback key and fails fast if no Ralph/Gemini env key exists — removes live API key from runner.
- `app/api/quickmode/route.ts:4` — replaced hardcoded Postgres URL with required `DATABASE_URL` — removes DB password from API source.
- `app/api/projects/scan/route.ts:6` — replaced admin-password fallback with required `ADMIN_PASSWORD` — removes admin password from source.
- `components/PRDGeneratorStep.tsx:339` — removed hardcoded scan admin header from client fetch — stops exposing the admin key in browser code.
- `CLAUDE.md:6` — replaced real auth/API examples with env-based examples — removes documented secrets.
- `app/api/prd/generate/route.ts:73`, `app/api/url-info/route.ts:31`, `app/api/quickmode/route.ts:32` — added invalid-JSON guards returning 400 — avoids malformed bodies falling through to 500.
- `sync_brands_page.js:16`, `test_brands.js:16`, `fix_rew_products.js:7`, `nina_full_monty.js:24`, `add_ai_desc_thibaut.js:5`, `ani_full_monty.js:17`, `croppy_glm.js:27`, `fix_dwpx_images.js:7`, `fix_x_mfr.js:3`, `glitter_full_monty.js:21`, `nina_crop.js:19`, `nina_names_colors.js:5`, `retro_full_monty.js:24`, `sequin_colors_titles.js:6`, `sequin_full_monty.js:15`, `sequin_monty_noimages.js:6` — replaced script API tokens/keys/DB URLs with env variables and fail-fast checks — removes live secrets from non-migration scripts.

## Deferred (needs Steve)
- P0 — `.env.local:1` — live secrets may remain in local env — left alone per instruction; rotate/purge history needs Steve.
- P0 — `scrape_dg_specs.js:12`, `migrate_global_to_custom.js:29` — remaining hardcoded DB/Shopify secrets — deferred because these are DDL/migration-adjacent scripts.
- P0 — `middleware.ts:6` — admin/process/API prefixes are public — auth/CSRF redesign is beyond safe fixes.
- P0 — `lib/auth.ts:8`, `app/api/auth/login/route.ts:58`, `middleware.ts:70` — sessions are unsigned and cookie `secure` is false — needs session design change.
- P0 — `app/api/ralph/run/route.ts:57`, `app/api/processes/start/route.ts:83`, `app/api/processes/stop/route.ts:17`, `app/api/live/check/route.ts:123` — arbitrary project/process control and shell execution risks — needs sandboxing/authorization.
- P0 — `app/api/url-info/route.ts:29` — public SSRF remains — needs URL/IP validation and rate limiting.
- P1 — `app/api/files/route.ts:14`, `app/api/directory/route.ts:71`, `app/api/upload/route.ts:16` — broad path access/upload/delete guards — needs realpath allowlist design.
- P1 — `app/api/projects/scan/route.ts:12`, `app/api/projects/scan/route.ts:215` — referer trust and shell interpolation remain — needs real authorization plus exec/native API rewrite.
- P1 — `lib/sheets.ts:32`, `app/api/ralph/status/route.ts:41` — concurrent JSON state writes/GET mutation — needs locking or durable state store.