`site-factory/CHANGES.md`

8 lines
Applied the safe fixes and wrote [CHANGES.md](/Users/stevestudio2/Projects/site-factory/CHANGES.md).

Changed:
- [admin/server.js](/Users/stevestudio2/Projects/site-factory/admin/server.js:15): removed hardcoded session secret fallback, added fail-fast validation, bound admin to `127.0.0.1`.
- [admin/.env.example](/Users/stevestudio2/Projects/site-factory/admin/.env.example:14): replaced weak placeholder with a long-secret placeholder.
- Stripe webhook routes for the three sites: production now fails closed if Stripe or `STRIPE_WEBHOOK_SECRET` is missing.

Per instructions, I did not run tests, install packages, or touch git. I also left `.env*`, PM2 config, schema/migrations, and broader auth/concurrency changes deferred in `CHANGES.md`.