`yolo-agent/CHANGES.md`

15 lines
Implemented the safe fixes and wrote [CHANGES.md](/Users/stevestudio2/Projects/yolo-agent/CHANGES.md).

Key points:
- Removed hardcoded live-looking secrets from the cited server/browser/source files.
- Added `.env.example` with placeholders only.
- Bound the Express server to `127.0.0.1`.
- Added JSON body guards.
- Escaped generated Shopify HTML in `body-html-cleanup`.
- Replaced several nonportable `/root` paths with project-relative paths.
- Updated the served `ledger-dist` bundle manually because `npm run build` failed: `tsc: command not found`.

Verification performed:
- Ran `node --check` on modified JS files.
- Searched modified app/source/bundle files for the flagged real secrets; none remain there.
- Did not run tests, install packages, or touch git.