security: strip hardcoded dw_admin secret; upgrade to env-first w/ passwordless-local fallback (this cfg had NO env-var path at all -- bare literal). No rotation/deploy.

0feba160a6399d9bad7fa0ead0b9da214d09962c · 2026-09-13 00:20:52 -0700 · Steve

Files touched

M ecosystem.config.cjs

Diff

commit 0feba160a6399d9bad7fa0ead0b9da214d09962c
Author: Steve <steve@designerwallcoverings.com>
Date:   Sun Sep 13 00:20:52 2026 -0700

    security: strip hardcoded dw_admin secret; upgrade to env-first w/ passwordless-local fallback (this cfg had NO env-var path at all -- bare literal). No rotation/deploy.
---
 ecosystem.config.cjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ecosystem.config.cjs b/ecosystem.config.cjs
index eacc6a5..c694b78 100644
--- a/ecosystem.config.cjs
+++ b/ecosystem.config.cjs
@@ -7,7 +7,7 @@ module.exports = {
       env: {
         PORT: 4020,
         NODE_ENV: 'production',
-        DATABASE_URL: 'postgresql://dw_admin:GDTfRN4cfYo8nwyiov0r22WF@127.0.0.1:5432/dw_unified',
+        DATABASE_URL: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/dw_unified'),
         AUTH_USER: 'admin',
         AUTH_PASS: 'DWSecure2024!',
         FRONTEND_URL: 'http://45.61.58.125:4030',

← 8861196 auto-save: 2026-06-21T18:53:00 (2 files) — ecosystem.config. · back to Dw Boardroom Governance · chore: version bump (session close, TK-11480 security fix) dc01372 →