`CHANGES.md`

24 lines

## Applied
- `lib/auth.ts:5` — removed the generated fallback session secret and now fail fast when `SESSION_SECRET` is missing — prevents predictable session signing.
- `app/api/webhooks/pulse-topic/route.ts:6` — removed the hardcoded webhook secret fallback and now fail fast when `WEBHOOK_SECRET` is missing — prevents accepting a public source secret.
- `lib/detect-mentions.ts:20` — removed the hardcoded Gemini API key fallback and now requires `GEMINI_API_KEY` before calling Gemini — prevents leaking or using an embedded API key.
- `app/api/drafts/auto-generate/route.ts:12` — replaced a hardcoded Gemini API key with `GEMINI_API_KEY` plus a fail-fast check — removes a real secret from source.
- `app/api/social/ai-compose/route.ts:4` — replaced a hardcoded Gemini API key with `GEMINI_API_KEY` plus a fail-fast check — removes a real secret from source.
- `.env.example:1` — added a placeholder `SESSION_SECRET` value — documents required config without committing a real secret.
- `.env.example:2` — added a placeholder `WEBHOOK_SECRET` value — documents required config without committing a real secret.
- `.env.example:3` — added a placeholder `GEMINI_API_KEY` value — documents required config without committing a real secret.

## Deferred (needs Steve)
- P0 — `.env.local:1`, `.env.local:3-5`, `.env.local:14`, `.env.local:21-22`, `CLAUDE.md:12-13`, `README.md:21` — live-looking secrets are committed/documented — requires owner rotation, history decision, and careful secret cleanup.
- P0 — `middleware.ts:55`, `app/api/social/ai-image/route.ts:20`, `app/api/social/bulk-schedule/route.ts:66`, `app/api/social/posts/approve/route.ts:10`, `app/api/social/posts/pending/route.ts:10` — forged cookies can reach social routes — auth model change was outside safe fixes.
- P0 — `app/api/pulse/petitions/route.ts:111` — public petition creation lacks abuse controls — moderation/rate-limit behavior needs product decision.
- P0 — `app/api/pulse/petitions/[id]/sign/route.ts:13` — public signing lacks rate limit and `allow_signatures` enforcement — abuse-control design needed.
- P0 — `app/api/nonprofit/enrich/route.ts:179`, `app/api/email-analyzer/fetch-url/route.ts:202`, `lib/social-crawl.ts:111` — arbitrary URL fetch can SSRF — needs a shared network guard and testing.
- P0 — `lib/cron-auth.ts:8`, `lib/auth.ts:179` — cron-secret fallback/cookie Secure behavior remains — not a literal hardcoded secret fallback; may affect deployment routing.
- P1 — `next.config.ts:5` — production ignores TypeScript/ESLint errors — could break builds if changed blindly.
- P1 — `app/api/auth/google/route.ts:15`, `app/api/auth/google/callback/route.ts:10` — OAuth lacks state validation — auth flow change needs testing.
- P1 — `app/api/nonprofit/signup/route.ts:170` — duplicate email race/unique index missing — database schema changes are forbidden.
- P1 — `db/schema.sql:252` — schema bootstrap issue — `.sql` edits are forbidden.
- P1 — `app/api/social/bulk-schedule/route.ts:108` — bulk schedule has no request size caps — validation behavior change outside safe list.
- P1 — `app/api/email-analyzer/fetch-url/route.ts:241` — response body read before truncation — network/body streaming refactor outside safe list.