Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice

4f2d74feb74159977001c54825e30b47644fcfbb · 2026-07-16 09:59:11 -0700 · Steve Abrams

Files touched

M serve.cjs
M vite.config.ts

Diff

commit 4f2d74feb74159977001c54825e30b47644fcfbb
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:59:11 2026 -0700

    Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice
---
 serve.cjs      | 2 +-
 vite.config.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/serve.cjs b/serve.cjs
index ca3bbcc..d52cefa 100644
--- a/serve.cjs
+++ b/serve.cjs
@@ -14,7 +14,7 @@ const DIST = path.join(__dirname, 'dist');
 
 // Shopify API config (Admin API — server-side only)
 const SHOPIFY_STORE = 'designer-laboratory-sandbox.myshopify.com';
-const SHOPIFY_TOKEN = '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';
+const SHOPIFY_TOKEN = (process.env.SHOPIFY_ADMIN_TOKEN || '');
 const SHOPIFY_API_VERSION = '2024-01';
 
 const MIME = {
diff --git a/vite.config.ts b/vite.config.ts
index 9765235..06c72e2 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -5,7 +5,7 @@ import https from 'https';
 // Shopify GraphQL search proxy for Vite dev server
 function shopifySearchPlugin() {
   const SHOPIFY_STORE = 'designer-laboratory-sandbox.myshopify.com';
-  const SHOPIFY_TOKEN = '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';
+  const SHOPIFY_TOKEN = (process.env.SHOPIFY_ADMIN_TOKEN || '');
   const API_VERSION = '2024-01';
 
   return {

← 8109610 gitignore: add backup file patterns (*.bak-*, *.pre-*, *.ori · back to Dw War Room · (newest)