security: strip hardcoded dw_admin secret -> env-first/passwordless; close .bak-<ts> gitignore gap (staged .env backup found live). No rotation/deploy.

b1ee94609644e5aa8fb5d3a5d4d549980f0221bf · 2026-09-13 00:20:10 -0700 · Steve

Files touched

M .gitignore
M ecosystem.config.js

Diff

commit b1ee94609644e5aa8fb5d3a5d4d549980f0221bf
Author: Steve <steve@designerwallcoverings.com>
Date:   Sun Sep 13 00:20:10 2026 -0700

    security: strip hardcoded dw_admin secret -> env-first/passwordless; close .bak-<ts> gitignore gap (staged .env backup found live). No rotation/deploy.
---
 .gitignore          | 1 +
 ecosystem.config.js | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index fb54bf4..c71612b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,6 +16,7 @@ build/
 # Snapshot/backup files — never commit
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
 *.orig
 *.swp
diff --git a/ecosystem.config.js b/ecosystem.config.js
index 7331543..42cc6f0 100644
--- a/ecosystem.config.js
+++ b/ecosystem.config.js
@@ -8,7 +8,7 @@ module.exports = {
       ARCHIVE_SCAN_MINUTES: 60,
       SHOPIFY_STORE: 'designer-laboratory-sandbox.myshopify.com',
       SHOPIFY_ADMIN_TOKEN: (process.env.SHOPIFY_ADMIN_TOKEN || ''),
-      DATABASE_URL: (process.env.DATABASE_URL || 'postgresql://dw_admin:GDTfRN4cfYo8nwyiov0r22WF@127.0.0.1:5432/dw_unified'),
+      DATABASE_URL: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/dw_unified'),
     },
     error_file: '/root/DW-Agents/archive-agent/logs/error.log',
     out_file: '/root/DW-Agents/archive-agent/logs/out.log',

← d8e9d87 Strip hardcoded Shopify API tokens from source (env-first); · back to Archive Agent · chore: version bump (session close, TK-11480 security fix) 67b6e18 →