Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice

657d8570710b86f84937b0aea708932b3ef2d6f6 · 2026-07-16 09:59:12 -0700 · Steve

Files touched

M US-001-IMPLEMENTATION.md
M test-koroseal-sample.ts

Diff

commit 657d8570710b86f84937b0aea708932b3ef2d6f6
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:59:12 2026 -0700

    Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice
---
 US-001-IMPLEMENTATION.md | 2 +-
 test-koroseal-sample.ts  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/US-001-IMPLEMENTATION.md b/US-001-IMPLEMENTATION.md
index 2f786478..918cc6bd 100644
--- a/US-001-IMPLEMENTATION.md
+++ b/US-001-IMPLEMENTATION.md
@@ -158,7 +158,7 @@ await client.updateProduct(productId, {
 ```bash
 SHOPIFY_STORE_DOMAIN=designer-laboratory-sandbox.myshopify.com
 SHOPIFY_ADMIN_API_VERSION=2024-01
-SHOPIFY_ADMIN_ACCESS_TOKEN=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
+SHOPIFY_ADMIN_ACCESS_TOKEN=shpat_REDACTED
 ```
 
 ### Shopify API Endpoints Used
diff --git a/test-koroseal-sample.ts b/test-koroseal-sample.ts
index 205d1327..8b55bf72 100755
--- a/test-koroseal-sample.ts
+++ b/test-koroseal-sample.ts
@@ -4,7 +4,7 @@ const fetch = globalThis.fetch; // node-fetch shim removed -- Node 26 global fet
 const config = {
   storeDomain: 'designer-laboratory-sandbox.myshopify.com',
   apiVersion: '2024-01',
-  accessToken: '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'
+  accessToken: (process.env.SHOPIFY_ADMIN_TOKEN || '')
 };
 
 async function getSample() {

← 35b42393 PR naturals v10 mailer: SISAL tile -> sisal search (page 1), · back to Dw Validator Debug TK11314 · auto-save: 2026-07-17T19:47:29 (351 files) — DW-Agents/dw-ag c85fdb51 →