← back to Credentials Agentabrams
data/credentials.json
118 lines
{
"meta": {
"title": "Credential Actions — agentabrams",
"umbrella_ticket": "TK-11786",
"source": "~/Projects/secrets-manager/ROTATION-CHECKLIST.md",
"note": "Every credential/secret that Steve must personally rotate or supply. Console-only actions are Steve's; Claude cannot mint keys or run prod credential changes. No secret VALUES stored here — only key names, mint URLs, and route-back commands.",
"generated_at": "2026-09-22T17:48:00-07:00"
},
"items": [
{
"id": "dw-admin-pg-pw",
"title": "PG dw_admin password",
"priority": "P1",
"status": "OUTSTANDING",
"class": "console-only",
"created_at": "2026-05-30T00:00:00-07:00",
"origin": "2026-05-30 Kamatera compromise",
"exposed": "Old plaintext still live in 4 local .env.local DATABASE_URL DSNs; apps connect cleanly → dw_admin role still uses the compromised pw.",
"runbook": "~/Projects/_shared/docs/pg-rotation-runbook.md",
"mint_url": null,
"console_steps": "Pick new ≥20-char pw → ALTER ROLE dw_admin WITH PASSWORD on prod Kamatera (sudo -u postgres psql) AND local Mac2 → restart pm2 fleet → fan out.",
"route_back": "NOT a `secrets add` key — dw_admin is embedded inline inside DATABASE_URL across ~40 pm2 apps + ~80 scripts (found by grepping for the OLD PASSWORD VALUE, not a var name). The runbook's own Step 2 script does the fan-out (search-and-replace across every .env). DW_ADMIN_DB_PASSWORD is unregistered in routes.json BY DESIGN — registering it generically would not correctly rewrite all those embedded DSNs. Follow the runbook exactly.",
"verify": "node ~/Projects/secrets-manager/cli.js check",
"why": "dw_admin is the shared admin used by wallco, the DW fleet, Norma sdcc, etc. Stays compromised until this runs. ~32 min operation covering local + Kamatera."
},
{
"id": "gemini-key-1",
"title": "Gemini API key #1 (Patty)",
"priority": "P2",
"status": "OUTSTANDING",
"class": "console-mint",
"created_at": "2026-06-01T00:00:00-07:00",
"exposed": "Hardcoded in 7 Patty routes + 3 DW docs.",
"runbook": null,
"mint_url": "https://aistudio.google.com/apikey",
"console_steps": "Create new key, DELETE the old one in the same console.",
"route_back": "printf 'GEMINI_API_KEY_PATTY=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste (registered 2026-09-23 → fans to ~/Projects/Patty/.env.local as GEMINI_API_KEY)",
"verify": "node ~/Projects/secrets-manager/cli.js check (hits Gemini /models)",
"why": "Exposed key on-disk; rotate + delete old. Route was previously UNREGISTERED (master GEMINI_API_KEY doesn't reach Patty) — fixed 2026-09-23."
},
{
"id": "gemini-key-2",
"title": "Gemini API key #2 (PoppyPetitions)",
"priority": "P2",
"status": "OUTSTANDING",
"class": "console-mint",
"created_at": "2026-06-01T00:00:00-07:00",
"exposed": "Hardcoded in PoppyPetitions/lib/gemini.ts.",
"runbook": null,
"mint_url": "https://aistudio.google.com/apikey",
"console_steps": "Create new key, DELETE the old one in the same console.",
"route_back": "printf 'GEMINI_API_KEY_POPPY=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste (registered 2026-09-23 → fans to ~/Projects/PoppyPetitions/.env.local as GEMINI_API_KEY)",
"verify": "node ~/Projects/secrets-manager/cli.js check",
"why": "Exposed key on-disk; rotate + delete old. Route was previously UNREGISTERED (master GEMINI_API_KEY doesn't reach PoppyPetitions) — fixed 2026-09-23."
},
{
"id": "repl-user-pg-pw",
"title": "PG repl_user replication password",
"priority": "P2",
"status": "OUTSTANDING",
"class": "console-only",
"created_at": "2026-06-03T00:00:00-07:00",
"exposed": "Lost (not leaked) — removed when the broken subscription was dropped 2026-06-03. dw_unified mirror stays frozen until reset.",
"runbook": "~/cncp-starter/yolo-queue/pending-approval/mirror-resync-FIX.md",
"mint_url": null,
"console_steps": "On Kamatera publisher: ALTER ROLE repl_user WITH PASSWORD; clear stray legacy table from publication dw_unified_pub.",
"route_back": "NOT a `secrets add` key — the new password is passed directly as an env var to the resync script (see verify), not fanned to any .env file. REPL_USER_DB_PASSWORD is intentionally unregistered in routes.json.",
"verify": "REPL_PW=<NEW_PW> bash ~/cncp-starter/yolo-queue/run-mirror-resync.sh — max(synced_at) jumps to now",
"why": "Unblocks the frozen dw_unified mirror (Vendors/edges/settlement panels)."
},
{
"id": "shopify-admin-token",
"title": "SHOPIFY_ADMIN_TOKEN (revoke leaked 7d19)",
"priority": "P1",
"status": "IN PROGRESS",
"class": "console-mint",
"created_at": "2026-09-22T00:00:00-07:00",
"exposed": "TK-12015 (2026-09-22): token shpat_…7d19 (app '81026 API', Dev Dashboard) LEAKED via pm2 env dump. NEW token shpat_…6755 (custom app, STORE ADMIN) minted 2026-09-23, verified LIVE (HTTP 200), routed locally + deployed to Kamatera prod. Fleet now runs on 6755. BUT: the OLD leaked 7d19 is STILL LIVE — uninstalling the '81026 API' app REVOKES it (zero downtime, fleet already on 6755).",
"runbook": "~/.claude/yolo-queue/pending-approval/TK-12015-rotate-shopify-admin-token-7d19.md",
"mint_url": null,
"console_steps": "Shopify store admin → Settings → Apps → Develop apps → find '81026 API' → uninstall. Then re-test: curl -s -H 'X-Shopify-Access-Token: shpat_…7d19' https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/shop.json → expect 401 (token dead).",
"route_back": "(NEW token already routed 2026-09-23; only revoke remains)",
"verify": "curl -s -H 'X-Shopify-Access-Token: shpat_…7d19' https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/shop.json — expect {\"errors\":\"[API] Invalid API key or access token\"} (HTTP 401)",
"why": "Leaked token MUST be revoked, not just replaced. The fleet is safe on 6755. Uninstalling '81026 API' kills 7d19 cleanly with NO downtime."
},
{
"id": "shopify-admin-token-new",
"title": "SHOPIFY_ADMIN_TOKEN (new 6755)",
"priority": "P1",
"status": "CONNECTED",
"class": "console-mint",
"created_at": "2026-09-23T00:00:00-07:00",
"exposed": "Replacement full-access token shpat_…6755 minted in the STORE ADMIN custom app.",
"runbook": null,
"mint_url": null,
"console_steps": "Verified LIVE (HTTP 200, shop id 1541177456), routed to 6 local dests + alias, deployed to Kamatera /root/DW-Agents/.env + pm2 reload.",
"route_back": "node ~/Projects/secrets-manager/cli.js add SHOPIFY_ADMIN_TOKEN …6755 (done)",
"verify": "curl -s -H 'X-Shopify-Access-Token: shpat_…6755' https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/shop.json → HTTP 200",
"why": "The live working token the fleet now runs on. Connected 2026-09-23."
},
{
"id": "slack-bot-token",
"title": "SLACK_BOT_TOKEN",
"priority": "P2",
"status": "CONNECTED",
"class": "console-mint",
"created_at": "2026-09-22T00:00:00-07:00",
"exposed": "Old xoxb-…jpmsq was in tracked source (ecosystem.config.cjs, git history).",
"runbook": "~/.claude/yolo-queue/pending-approval/tk11786-rotate-exposed-secrets.md",
"mint_url": "https://api.slack.com/apps",
"console_steps": "Rotated by Steve → new token ends …OlqR, verified LIVE via auth.test (ok:true, team Designerwallcoverings, bot dw_reports_bot). Left: confirm old …jpmsq is revoked in Slack app admin + push new token to Kamatera prod.",
"route_back": "node ~/Projects/secrets-manager/cli.js add SLACK_BOT_TOKEN …OlqR (done)",
"verify": "curl -s -H 'Authorization: Bearer <token>' https://slack.com/api/auth.test → ok:true",
"why": "Rotated + verified live this session. Connected 2026-09-22."
}
]
}