`Designer-Wallcoverings/rereview.md`

23 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
admin/server.ts:19 — hardcoded default admin credential — now fail-fast env lookup — STATUS good  
admin/server.ts:427 — startup log disclosed admin password — now logs configured-only message — STATUS good  
brand-router/server.js:11 — hardcoded Shopify token — now env lookup with fail-fast — STATUS concern  
brand-router/server.js:13 — hardcoded Gemini key — now env lookup with fail-fast — STATUS good  
brand-router/server.js:14 — hardcoded basic-auth password — server moved to env, but companion client still uses old literal password — STATUS broken  
DW-Websites/shop-by-color/server.js:9 — hardcoded Shopify token — now env lookup with fail-fast — STATUS good  
DW-Agents/dw-agents/in-parallel-agent.ts:611 — request-body crash — now safely extracts from `req.body || {}` and rejects invalid message — STATUS good  
.env.example:12 — missing secret placeholders — placeholders added — STATUS good

## New issues introduced
brand-router/create-vendor-collections.js:479 — `/api/regenerate-html` call still authenticates as `admin:DWSecure2024!`; unless `BRAND_ROUTER_PASSWORD` is set to that exact old password, the workflow now gets 401 and HTML regeneration silently degrades to a warning — severity P1

## Missed call-sites (same problem elsewhere)
brand-router/create-vendor-collections.js:24 — same hardcoded Shopify token pattern still present in the brand-router companion script  
brand-router/create-vendor-collections.js:479 — same hardcoded basic-auth password pattern still present after moving brand-router auth to `BRAND_ROUTER_PASSWORD`

## Recommendations
- Update `brand-router/create-vendor-collections.js` to read the same env vars as `brand-router/server.js`, especially `BRAND_ROUTER_PASSWORD` and `BRAND_ROUTER_SHOPIFY_TOKEN`.
- Consider failing the collection script when regeneration returns 401; currently it logs a warning and continues to push potentially stale HTML.