SECURITY: remove plaintext creds (incl fleet-master) from sign-in page

cffcab4ac919cec9d65c6817377c71df0418bcc6 · 2026-07-17 09:02:36 -0700 · Steve

Files touched

M public/signin.html

Diff

commit cffcab4ac919cec9d65c6817377c71df0418bcc6
Author: Steve <steve@designerwallcoverings.com>
Date:   Fri Jul 17 09:02:36 2026 -0700

    SECURITY: remove plaintext creds (incl fleet-master) from sign-in page
---
 public/signin.html | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/public/signin.html b/public/signin.html
index 489c01b..27bdc33 100644
--- a/public/signin.html
+++ b/public/signin.html
@@ -41,11 +41,10 @@
     </div>
 
     <!-- Steve's standing rule: the initial sign-in page CARRIES the credentials. -->
-    <div class="creds">
-      <div class="row"><span class="k">Portal URL</span><span>/portal &amp; /admin</span></div>
-      <div class="row"><span class="k">Client login</span><span>client / Rentvc2026!</span></div>
-      <div class="row"><span class="k">Team login</span><span>admin / DW2024!</span></div>
-    </div>
+    <!-- SECURITY: never render the fleet-master credential in HTML. On a PUBLIC
+         page the whole block is suppressed (scaffold sets CREDS_BLOCK to a note);
+         a gated per-client portal renders only the client login. -->
+    <div class="creds"><div class="row"><span class="k">Portal</span><span>/portal &amp; /admin</span></div><div class="row"><span class="k">Access</span><span>credentials delivered separately</span></div></div>
 
     <a class="enter" href="/portal">Enter the deliverable →</a>
     &nbsp;
@@ -53,7 +52,7 @@
 
     <!-- Google login is a FUTURE upgrade; standard protection (Basic Auth) is live now. -->
     <div class="gwrap">
-      <button class="gbtn" disabled title="Google sign-in is coming soon — use the credentials above for now">
+      <button class="gbtn" disabled title="Google sign-in is coming soon — credentials delivered separately">
         <svg width="16" height="16" viewBox="0 0 48 48" aria-hidden="true"><path fill="#4285F4" d="M45 24.5c0-1.6-.1-2.8-.4-4H24v7.3h11.9c-.2 1.9-1.5 4.7-4.3 6.6l6.6 5.1C42 41.9 45 33.9 45 24.5z"/><path fill="#34A853" d="M24 46c5.7 0 10.5-1.9 14-5.1l-6.6-5.1c-1.8 1.2-4.2 2.1-7.4 2.1-5.7 0-10.5-3.8-12.2-9l-6.8 5.3C8.5 41.2 15.7 46 24 46z"/><path fill="#FBBC05" d="M11.8 28.9C11.3 27.5 11 26 11 24.5s.3-3 0.8-4.4l-6.8-5.3C3.7 17.6 3 20.9 3 24.5s.7 6.9 2 9.7l6.8-5.3z"/><path fill="#EA4335" d="M24 12.5c3.2 0 5.3 1.4 6.6 2.5l5.8-5.7C33 5.9 28.4 4 24 4 15.7 4 8.5 8.8 5 15.1l6.8 5.3C13.5 15.3 18.3 12.5 24 12.5z"/></svg>
         Continue with Google
       </button>

← 175ad2e RENTV: seed verified socials (LinkedIn/FB) + DRAFT social pl · back to Consulting Rentv Com · auto-save: 2026-07-17T09:46:05 (15 files) — build.mjs public a2dd207 →