Record pitch-site Basic-Auth rotation to fleet-standard cred

30bfd4f34f9e3941cc86a78110756c46de62d9e3 · 2026-08-17 10:02:45 -0700 · Steve

Files touched

A CHANGELOG.md

Diff

commit 30bfd4f34f9e3941cc86a78110756c46de62d9e3
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon Aug 17 10:02:45 2026 -0700

    Record pitch-site Basic-Auth rotation to fleet-standard cred
---
 CHANGELOG.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..e30b9e4
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,13 @@
+# dw-pitch-followup — changelog
+
+## 2026-08-17
+- **Rotated public tunnel Basic-Auth to the shared fleet credential.**
+  Changed `BASIC_AUTH` in the (gitignored) `.env` from the site-specific
+  password to the standard fleet cred (`admin` / fleet password), then
+  `pm2 restart dw-pitch-followup --update-env` so the process re-read `.env`.
+  The pm2 env leaves `BASIC_AUTH` unset, so the app resolves it from `.env`
+  via `envLocal()` at startup (`server.js:97`).
+  Verified: `http://pitch.designerwallcoverings.com/` → 200 with the new cred;
+  old cred and no-cred → 401. The restart also reset the in-memory
+  brute-force lockout map (`server.js:112`), clearing a prior 429.
+  NOTE: prospects previously handed the old password must now use the new one.

← 32ac85c chore: v0.6.0 (session close) — catch-all route, Gmail corre · back to Dw Pitch Followup · auto-data-snapshot: 2026-08-17T20:02:38 (1 data files) — dat 9f1d378 →