Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice

22ea2cb8702b49d426c35f07d04b7a845004dd90 · 2026-07-16 09:59:11 -0700 · Steve Abrams

Files touched

M _PRIORITY_PATCHES.md

Diff

commit 22ea2cb8702b49d426c35f07d04b7a845004dd90
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:59:11 2026 -0700

    Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice
---
 _PRIORITY_PATCHES.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/_PRIORITY_PATCHES.md b/_PRIORITY_PATCHES.md
index b193dd6..51010c6 100644
--- a/_PRIORITY_PATCHES.md
+++ b/_PRIORITY_PATCHES.md
@@ -42,7 +42,7 @@ Plus a 2nd key `${GOOGLE_API_KEY}` in `~/Projects/SDCC-Stories/lib/gemini.js:9`.
 **Action**: rotate both at https://aistudio.google.com/app/apikey, sed-replace literals with `process.env.GEMINI_API_KEY`.
 
 ## 🚨 P0 — LIVE Shopify admin token hardcoded in **18+ files** (single token mass leak)
-Token `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` appears in:
+Token `shpat_REDACTED` appears in:
 ```
 ~/Projects/archive-agent/server.js:15                         (env-fallback)
 ~/Projects/archive-agent/ecosystem.config.js:10               (raw in pm2 env block)

← d8a1074 chore: untrack stray .bak/.pre-* backups + add gitignore pat · back to Codex Review 2026 04 30 · (newest)