[object Object]

← back to Norma

security: strip hardcoded dw_admin DSN password -> env-first (DATABASE_URL); passwordless localhost fallback. No rotation/deploy.

1033d7fdb04dd2d6eb7e4c30dbba7090a8bfe534 · 2026-05-30 09:32:15 -0700 · Steve Abrams

Files touched

Diff

commit 1033d7fdb04dd2d6eb7e4c30dbba7090a8bfe534
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 09:32:15 2026 -0700

    security: strip hardcoded dw_admin DSN password -> env-first (DATABASE_URL); passwordless localhost fallback. No rotation/deploy.
---
 agents/datasource-agent/skills/collect-statements.js | 2 +-
 agents/datasource-agent/skills/discover-apis.js      | 2 +-
 agents/datasource-agent/skills/rate-sources.js       | 2 +-
 agents/datasource-agent/skills/report.js             | 2 +-
 agents/datasource-agent/skills/scrape-frontpages.js  | 2 +-
 agents/datasource-agent/skills/scrape-petitions.js   | 2 +-
 agents/shared/db.js                                  | 2 +-
 petition-site/server.js                              | 2 +-
 scripts/batch-resolve-authors.js                     | 2 +-
 scripts/enrich-college-scorecard.js                  | 2 +-
 scripts/enrich-news-ai.js                            | 2 +-
 scripts/enrich-politicians.js                        | 2 +-
 scripts/enrich-zip-profiles.js                       | 2 +-
 scripts/ingest-all-sources.js                        | 2 +-
 scripts/ingest-congress.js                           | 2 +-
 scripts/ingest-org-feeds.js                          | 2 +-
 scripts/ingest-scorecard-urban.js                    | 2 +-
 scripts/ingest-scorecard.js                          | 2 +-
 scripts/ingest-staffers.js                           | 2 +-
 scripts/populate-staffers.js                         | 2 +-
 scripts/search-latimes-gmail.js                      | 2 +-
 21 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/agents/datasource-agent/skills/collect-statements.js b/agents/datasource-agent/skills/collect-statements.js
index fcf8516..e34e773 100644
--- a/agents/datasource-agent/skills/collect-statements.js
+++ b/agents/datasource-agent/skills/collect-statements.js
@@ -16,7 +16,7 @@ const PLATFORM = 'nonprofits';
 const GEMINI_URL =
   'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${GOOGLE_API_KEY}';
 
-const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc';
 
 const PRESS_PATHS = ['/press', '/news', '/blog', '/press-releases', '/media', '/newsroom', '/updates', '/statements'];
 
diff --git a/agents/datasource-agent/skills/discover-apis.js b/agents/datasource-agent/skills/discover-apis.js
index aaeac71..0d4e8b8 100644
--- a/agents/datasource-agent/skills/discover-apis.js
+++ b/agents/datasource-agent/skills/discover-apis.js
@@ -16,7 +16,7 @@ const PLATFORM = 'data-apis';
 const GEMINI_URL =
   'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${GOOGLE_API_KEY}';
 
-const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc';
 
 // Lazy-load pg pool
 let _pool;
diff --git a/agents/datasource-agent/skills/rate-sources.js b/agents/datasource-agent/skills/rate-sources.js
index 0a95df9..93f0a55 100644
--- a/agents/datasource-agent/skills/rate-sources.js
+++ b/agents/datasource-agent/skills/rate-sources.js
@@ -15,7 +15,7 @@ const PLATFORM = 'rating';
 const GEMINI_URL =
   'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${GOOGLE_API_KEY}';
 
-const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc';
 
 let _pool;
 function getPool() {
diff --git a/agents/datasource-agent/skills/report.js b/agents/datasource-agent/skills/report.js
index 2245855..35912f7 100644
--- a/agents/datasource-agent/skills/report.js
+++ b/agents/datasource-agent/skills/report.js
@@ -12,7 +12,7 @@ const { logAction } = require('../../shared/audit-logger');
 const AGENT = 'datasource-agent';
 const PLATFORM = 'report';
 
-const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc';
 
 let _pool;
 function getPool() {
diff --git a/agents/datasource-agent/skills/scrape-frontpages.js b/agents/datasource-agent/skills/scrape-frontpages.js
index f6177fd..82c5b49 100644
--- a/agents/datasource-agent/skills/scrape-frontpages.js
+++ b/agents/datasource-agent/skills/scrape-frontpages.js
@@ -17,7 +17,7 @@ const PLATFORM = 'newspapers';
 const GEMINI_URL =
   'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${GOOGLE_API_KEY}';
 
-const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc';
 
 let _pool;
 function getPool() {
diff --git a/agents/datasource-agent/skills/scrape-petitions.js b/agents/datasource-agent/skills/scrape-petitions.js
index 1ca3342..f1cc1dc 100644
--- a/agents/datasource-agent/skills/scrape-petitions.js
+++ b/agents/datasource-agent/skills/scrape-petitions.js
@@ -18,7 +18,7 @@ const PLATFORM = 'petitions';
 const GEMINI_URL =
   'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${GOOGLE_API_KEY}';
 
-const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc';
 
 let _pool;
 function getPool() {
diff --git a/agents/shared/db.js b/agents/shared/db.js
index 35db512..87eba6a 100644
--- a/agents/shared/db.js
+++ b/agents/shared/db.js
@@ -8,7 +8,7 @@
 const { Pool } = require('pg');
 
 const pool = new Pool({
-  connectionString: process.env.DATABASE_URL || 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc',
+  connectionString: process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc',
   max: 10,
   idleTimeoutMillis: 30000,
   connectionTimeoutMillis: 5000,
diff --git a/petition-site/server.js b/petition-site/server.js
index 92da3b6..bc63836 100644
--- a/petition-site/server.js
+++ b/petition-site/server.js
@@ -23,7 +23,7 @@ app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 
 const pool = new Pool({
-  connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc',
+  connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc'),
 });
 
 async function query(text, params) {
diff --git a/scripts/batch-resolve-authors.js b/scripts/batch-resolve-authors.js
index f8c360d..9a95d6f 100644
--- a/scripts/batch-resolve-authors.js
+++ b/scripts/batch-resolve-authors.js
@@ -5,7 +5,7 @@
  */
 const { Pool } = require('pg');
 
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc' });
+const pool = new Pool({ connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc') });
 const GEMINI_KEY = '${GOOGLE_API_KEY}';
 const GEMINI_URL = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${GEMINI_KEY}`;
 
diff --git a/scripts/enrich-college-scorecard.js b/scripts/enrich-college-scorecard.js
index a9a854e..9e05137 100644
--- a/scripts/enrich-college-scorecard.js
+++ b/scripts/enrich-college-scorecard.js
@@ -12,7 +12,7 @@
 
 const { Pool } = require('pg');
 const pool = new Pool({
-  connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc',
+  connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc'),
 });
 
 const API_KEYS = [
diff --git a/scripts/enrich-news-ai.js b/scripts/enrich-news-ai.js
index f31d3f6..fc1654c 100644
--- a/scripts/enrich-news-ai.js
+++ b/scripts/enrich-news-ai.js
@@ -13,7 +13,7 @@
 const { Pool } = require('pg');
 const https = require('https');
 
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc' });
+const pool = new Pool({ connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc') });
 
 function getGeminiUrl() {
   const geminiKey = process.env.GEMINI_API_KEY;
diff --git a/scripts/enrich-politicians.js b/scripts/enrich-politicians.js
index e4704bf..0c75de4 100644
--- a/scripts/enrich-politicians.js
+++ b/scripts/enrich-politicians.js
@@ -7,7 +7,7 @@
  */
 
 const { Pool } = require('pg');
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc' });
+const pool = new Pool({ connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc') });
 
 // ─── Committee Pools ────────────────────────────────────────────────────────────
 
diff --git a/scripts/enrich-zip-profiles.js b/scripts/enrich-zip-profiles.js
index 11d1674..5a18a0b 100644
--- a/scripts/enrich-zip-profiles.js
+++ b/scripts/enrich-zip-profiles.js
@@ -13,7 +13,7 @@
 
 const { Pool } = require('pg');
 
-const DB = process.env.DATABASE_URL || 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB = process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc';
 const pool = new Pool({ connectionString: DB, max: 5 });
 
 const args = process.argv.slice(2);
diff --git a/scripts/ingest-all-sources.js b/scripts/ingest-all-sources.js
index 3c47ddb..e54ab55 100755
--- a/scripts/ingest-all-sources.js
+++ b/scripts/ingest-all-sources.js
@@ -16,7 +16,7 @@
 const { Pool } = require('pg');
 
 // ── Configuration ───────────────────────────────────────────────────────
-const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc';
 const pool = new Pool({ connectionString: DB_URL, max: 5 });
 
 // Parse CLI args
diff --git a/scripts/ingest-congress.js b/scripts/ingest-congress.js
index f6e5fb8..14d9d07 100644
--- a/scripts/ingest-congress.js
+++ b/scripts/ingest-congress.js
@@ -6,7 +6,7 @@
  */
 
 const { Pool } = require('pg');
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc' });
+const pool = new Pool({ connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc') });
 
 const FIPS = {
   'Alabama':'01','Alaska':'02','Arizona':'04','Arkansas':'05','California':'06',
diff --git a/scripts/ingest-org-feeds.js b/scripts/ingest-org-feeds.js
index d6c82db..6526836 100644
--- a/scripts/ingest-org-feeds.js
+++ b/scripts/ingest-org-feeds.js
@@ -10,7 +10,7 @@ const { Pool } = require('pg');
 const https = require('https');
 const http = require('http');
 
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc' });
+const pool = new Pool({ connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc') });
 
 function fetchUrl(url) {
   return new Promise((resolve, reject) => {
diff --git a/scripts/ingest-scorecard-urban.js b/scripts/ingest-scorecard-urban.js
index 4f80386..3398bb7 100644
--- a/scripts/ingest-scorecard-urban.js
+++ b/scripts/ingest-scorecard-urban.js
@@ -12,7 +12,7 @@
  */
 
 const { Pool } = require('pg');
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc' });
+const pool = new Pool({ connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc') });
 
 const URBAN_BASE = 'https://educationdata.urban.org/api/v1';
 
diff --git a/scripts/ingest-scorecard.js b/scripts/ingest-scorecard.js
index d4aa51b..11c2744 100644
--- a/scripts/ingest-scorecard.js
+++ b/scripts/ingest-scorecard.js
@@ -7,7 +7,7 @@
  */
 
 const { Pool } = require('pg');
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc' });
+const pool = new Pool({ connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc') });
 
 const API_KEY = process.env.SCORECARD_API_KEY || 'DEMO_KEY';
 const BASE = 'https://api.data.gov/ed/collegescorecard/v1/schools';
diff --git a/scripts/ingest-staffers.js b/scripts/ingest-staffers.js
index be7d02e..533e199 100644
--- a/scripts/ingest-staffers.js
+++ b/scripts/ingest-staffers.js
@@ -19,7 +19,7 @@ const { Pool } = require('pg');
 const https = require('https');
 const http = require('http');
 
-const DB_URL = 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc');
 const pool = new Pool({ connectionString: DB_URL });
 
 // ---------------------------------------------------------------------------
diff --git a/scripts/populate-staffers.js b/scripts/populate-staffers.js
index b95171a..c1d25ea 100644
--- a/scripts/populate-staffers.js
+++ b/scripts/populate-staffers.js
@@ -13,7 +13,7 @@
 
 const { Pool } = require('pg');
 
-const DB_URL = 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc');
 const pool = new Pool({ connectionString: DB_URL });
 
 const BATCH_SIZE = 100;
diff --git a/scripts/search-latimes-gmail.js b/scripts/search-latimes-gmail.js
index f4ec853..81eef35 100644
--- a/scripts/search-latimes-gmail.js
+++ b/scripts/search-latimes-gmail.js
@@ -7,7 +7,7 @@
 const { google } = require('googleapis');
 const { Client } = require('pg');
 
-const DB_URL = 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc';
+const DB_URL = (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc');
 const GMAIL_CLIENT_ID = '462032529853-ef07ls3dgvm61l4esuefjofv8s1eimkk.apps.googleusercontent.com';
 const GMAIL_CLIENT_SECRET = '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';
 const REDIRECT_URI = 'http://localhost';

← 36d0cb1 wire Morning Batch + weekly_intelligence to PM2 cron — fixes  ·  back to Norma  ·  security: strip hardcoded dw_admin DSN password -> env-first bde9449 →