Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice

56a9673e03a959b4b8286fcf140c46a4caae1a56 · 2026-07-16 09:59:12 -0700 · Steve Abrams

Files touched

M lincrusta-reprice.js

Diff

commit 56a9673e03a959b4b8286fcf140c46a4caae1a56
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:59:12 2026 -0700

    Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice
---
 lincrusta-reprice.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lincrusta-reprice.js b/lincrusta-reprice.js
index 0bec2bf..1198d8e 100644
--- a/lincrusta-reprice.js
+++ b/lincrusta-reprice.js
@@ -6,7 +6,7 @@
  */
 
 const https = require('https');
-const TOKEN = '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';
+const TOKEN = (process.env.SHOPIFY_ADMIN_TOKEN || '');
 
 // PDF Price List 2026 — mapped by RD/WM item number
 const PRICE_LIST = {

← b82ac86 security: strip hardcoded dw_admin DSN password -> env-first · back to StudentLoanTracker · (newest)