security: strip hardcoded dw_admin DSN password -> env-first. No rotation/deploy.

795a4f49ed239e75b6c2ab88c243c2eae2dc63ca · 2026-05-30 09:32:49 -0700 · steve

Files touched

M server.js

Diff

commit 795a4f49ed239e75b6c2ab88c243c2eae2dc63ca
Author: steve <steve@designerwallcoverings.com>
Date:   Sat May 30 09:32:49 2026 -0700

    security: strip hardcoded dw_admin DSN password -> env-first. No rotation/deploy.
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index bd98f53..9f8317d 100644
--- a/server.js
+++ b/server.js
@@ -123,7 +123,7 @@ function setSetting(key, value) { db.prepare('INSERT OR REPLACE INTO settings (k
 let districtLookup = {};
 try {
   const { Pool } = require('pg');
-  const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/sdcc', max: 2 });
+  const pool = new Pool({ connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/sdcc'), max: 2 });
   pool.query('SELECT zip_codes, district_code, representative_name, representative_party FROM congressional_districts WHERE representative_name IS NOT NULL LIMIT 500')
     .then(result => {
       for (const row of result.rows) {

← ae4222d snapshot: 2 file(s) changed, ~2 modified · back to SDCC Stories · gitignore: add *.bak-* *.pre-* *.orig patterns to prevent ba 8c69aad →