fix credentials dashboard: Shopify token RESOLVED→OUTSTANDING (TK-12015 7d19 leak still live; measured 'works' not 'rotated' — TK-11431 false-green class)

fffe6ab58fbbce5a3d0d4a70826225ebd2d7017e · 2026-09-23 09:03:38 -0700 · Steve

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M data/credentials.json

Diff

commit fffe6ab58fbbce5a3d0d4a70826225ebd2d7017e
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Sep 23 09:03:38 2026 -0700

    fix credentials dashboard: Shopify token RESOLVED→OUTSTANDING (TK-12015 7d19 leak still live; measured 'works' not 'rotated' — TK-11431 false-green class)
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 data/credentials.json | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/data/credentials.json b/data/credentials.json
index 2bb7daf..c296578 100644
--- a/data/credentials.json
+++ b/data/credentials.json
@@ -70,19 +70,18 @@
     },
     {
       "id": "shopify-admin-token",
-      "title": "SHOPIFY_ADMIN_TOKEN",
-      "priority": "P3",
-      "status": "RESOLVED",
+      "title": "SHOPIFY_ADMIN_TOKEN (7d19)",
+      "priority": "P2",
+      "status": "OUTSTANDING",
       "class": "console-mint",
-      "created_at": "2026-06-03T00:00:00-07:00",
-      "resolved_at": "2026-06-21T00:00:00-07:00",
-      "exposed": "Re-verified 2026-06-21: token WORKS (HTTP 200 against /admin/api/2024-04/shop.json). The earlier 'burned' text no longer holds.",
-      "runbook": null,
-      "mint_url": "https://admin.shopify.com (custom app → API credentials)",
-      "console_steps": "N/A — resolved.",
+      "created_at": "2026-09-22T00:00:00-07:00",
+      "exposed": "TK-12015 (2026-09-22): token shpat_…7d19 (app '81026 API') LEAKED via a pm2 env dump pasted into a Claude session, and is CONFIRMED STILL LIVE (HTTP 200). 'Verified working' is NOT 'rotated' — a live leaked token is an outstanding rotation. Contained (private paste, not committed/public), rotate as hygiene.",
+      "runbook": "~/.claude/yolo-queue/pending-approval/TK-12015-rotate-shopify-admin-token-7d19.md",
+      "mint_url": "https://admin.shopify.com (Dev Dashboard app → INSTALL on designer-laboratory-sandbox to mint shpat_)",
+      "console_steps": "BLOCKED on Shopify UI: create/use an app with EXACTLY read/write_products + read/write_publications, then INSTALL it on designer-laboratory-sandbox to mint the shpat_ token (the missing step). Custom-app API access is currently OFF on the store — re-enable it OR install a backed app. Best done in Claude Desktop (browser control). ~5 min in a fresh session.",
       "route_back": "printf 'SHOPIFY_ADMIN_TOKEN=<NEW_TOKEN>' | node ~/Projects/secrets-manager/cli.js import-paste",
       "verify": "node ~/Projects/secrets-manager/cli.js check",
-      "why": "Separate credential; verified live. Does NOT clear the dw_admin compromise flag."
+      "why": "Live leaked admin token (read/write products+publications). Corrected 2026-09-23 from a stale 'RESOLVED' that measured 'works' not 'rotated' — the TK-11431 false-green class."
     }
   ]
 }

← 51fb769 initial scaffold: credentials.agentabrams.com credential-act · back to Credentials Agentabrams · update shopify credential status — 6755 live + routed, revok 89e7b0f →