← back to Dwjs Consolidation 2026 04 23

Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice

d50c409a777117e0b6cded39e5e603de85d2d40f · 2026-07-16 09:59:11 -0700 · Steve Abrams

Files touched

• M audit_completeness.js
• M audit_phase1.js
• M autofix_inventory.js
• M dwjs_mfr_apply.js
• M dwjs_mfr_dryrun.js
• M dwqw_survey.js
• M fix_bodies.js
• M hollywood_archived_audit.js
• M hollywood_mfr_apply.js
• M hollywood_mfr_dryrun.js
• M phase3_execute.js
• M phase3_legacy_renumber.js
• M phase3_prepare_jeffrey_stevens.js
• M phase3_prepare_v2.js
• M phase4_dwqw_collections.js
• M qty_backfill.js
• M qty_coverage_audit.js
• M reactivate.js
• M spin_detect_delete.js

Diff

commit d50c409a777117e0b6cded39e5e603de85d2d40f
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:59:11 2026 -0700

    Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice
---
 audit_completeness.js             | 2 +-
 audit_phase1.js                   | 2 +-
 autofix_inventory.js              | 2 +-
 dwjs_mfr_apply.js                 | 2 +-
 dwjs_mfr_dryrun.js                | 2 +-
 dwqw_survey.js                    | 2 +-
 fix_bodies.js                     | 2 +-
 hollywood_archived_audit.js       | 2 +-
 hollywood_mfr_apply.js            | 2 +-
 hollywood_mfr_dryrun.js           | 2 +-
 phase3_execute.js                 | 2 +-
 phase3_legacy_renumber.js         | 2 +-
 phase3_prepare_jeffrey_stevens.js | 2 +-
 phase3_prepare_v2.js              | 2 +-
 phase4_dwqw_collections.js        | 2 +-
 qty_backfill.js                   | 2 +-
 qty_coverage_audit.js             | 2 +-
 reactivate.js                     | 2 +-
 spin_detect_delete.js             | 2 +-
 19 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/audit_completeness.js b/audit_completeness.js
index 92742b5..6f27914 100644
--- a/audit_completeness.js
+++ b/audit_completeness.js
@@ -18,7 +18,7 @@ const fs = require('fs');
 const path = require('path');
 
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 
 function gql(body, retry=0) {
   return new Promise((resolve, reject) => {
diff --git a/audit_phase1.js b/audit_phase1.js
index 2b80004..26f4fa4 100644
--- a/audit_phase1.js
+++ b/audit_phase1.js
@@ -20,7 +20,7 @@ const fs = require('fs');
 const path = require('path');
 
 const STORE = 'designer-laboratory-sandbox.myshopify.com';
-const TOKEN = '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';
+const TOKEN = (process.env.SHOPIFY_ADMIN_TOKEN || '');
 const API = '/admin/api/2024-10/graphql.json';
 const OUT = __dirname;
 const NEW_SKU_START = 90000;
diff --git a/autofix_inventory.js b/autofix_inventory.js
index db5f0b9..0579498 100644
--- a/autofix_inventory.js
+++ b/autofix_inventory.js
@@ -14,7 +14,7 @@ const fs = require('fs');
 const path = require('path');
 
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 
 const LOG = '/Users/macstudio3/Projects/dwjs-consolidation-2026-04-23/autofix_inventory.log';
 const EXEC = '/Users/macstudio3/Projects/dwjs-consolidation-2026-04-23/autofix_inventory.ndjson';
diff --git a/dwjs_mfr_apply.js b/dwjs_mfr_apply.js
index ebf7429..c9f8b88 100644
--- a/dwjs_mfr_apply.js
+++ b/dwjs_mfr_apply.js
@@ -3,7 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const SHOP='designer-laboratory-sandbox.myshopify.com';
 const API=`https://${SHOP}/admin/api/2024-10/graphql.json`;
 
diff --git a/dwjs_mfr_dryrun.js b/dwjs_mfr_dryrun.js
index bb39017..1a805c7 100644
--- a/dwjs_mfr_dryrun.js
+++ b/dwjs_mfr_dryrun.js
@@ -4,7 +4,7 @@
 const fs = require('fs');
 const path = require('path');
 
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const SHOP='designer-laboratory-sandbox.myshopify.com';
 const API=`https://${SHOP}/admin/api/2024-10/graphql.json`;
 
diff --git a/dwqw_survey.js b/dwqw_survey.js
index ca3898f..6727a71 100644
--- a/dwqw_survey.js
+++ b/dwqw_survey.js
@@ -2,7 +2,7 @@
 // Survey DWQW active products for natural collection groupings
 const https = require('https');
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 function gql(b){return new Promise((res,rej)=>{const d=JSON.stringify(b);const r=https.request({hostname:STORE,path:'/admin/api/2024-10/graphql.json',method:'POST',headers:{'X-Shopify-Access-Token':TOKEN,'Content-Type':'application/json','Content-Length':Buffer.byteLength(d)}},R=>{let c='';R.on('data',x=>c+=x);R.on('end',()=>{try{res(JSON.parse(c))}catch{res({})}})});r.on('error',rej);r.setTimeout(60000,()=>{r.destroy();rej(new Error('t'))});r.write(d);r.end();});}
 
 (async()=>{
diff --git a/fix_bodies.js b/fix_bodies.js
index f289b8c..35626d1 100644
--- a/fix_bodies.js
+++ b/fix_bodies.js
@@ -14,7 +14,7 @@ const https = require('https');
 const fs = require('fs');
 
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const LOG = '/Users/macstudio3/Projects/dwjs-consolidation-2026-04-23/fix_bodies.log';
 const log = m => { const l=`[${new Date().toISOString().slice(0,19)}] ${m}\n`; process.stdout.write(l); fs.appendFileSync(LOG,l); };
 
diff --git a/hollywood_archived_audit.js b/hollywood_archived_audit.js
index e73045f..a4dce90 100644
--- a/hollywood_archived_audit.js
+++ b/hollywood_archived_audit.js
@@ -1,6 +1,6 @@
 // Pull ALL archived Hollywood Wallcoverings → score reactivation eligibility.
 const fs=require('fs');
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const SHOP='designer-laboratory-sandbox.myshopify.com';
 const API=`https://${SHOP}/admin/api/2024-10/graphql.json`;
 
diff --git a/hollywood_mfr_apply.js b/hollywood_mfr_apply.js
index c1fccf3..ec20455 100644
--- a/hollywood_mfr_apply.js
+++ b/hollywood_mfr_apply.js
@@ -1,6 +1,6 @@
 // Apply: write real mfr SKU from fmpro into custom.manufacturer_sku for 2,786 Hollywood products.
 const fs = require('fs');
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const SHOP='designer-laboratory-sandbox.myshopify.com';
 const API=`https://${SHOP}/admin/api/2024-10/graphql.json`;
 const STATE = __dirname + '/hollywood_apply_state.json';
diff --git a/hollywood_mfr_dryrun.js b/hollywood_mfr_dryrun.js
index e989bc4..282cb18 100644
--- a/hollywood_mfr_dryrun.js
+++ b/hollywood_mfr_dryrun.js
@@ -1,6 +1,6 @@
 // Dry-run: find Hollywood Wallcoverings products, look up real mfr SKU in fmpro, report what would change.
 const fs = require('fs');
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const SHOP='designer-laboratory-sandbox.myshopify.com';
 const API=`https://${SHOP}/admin/api/2024-10/graphql.json`;
 
diff --git a/phase3_execute.js b/phase3_execute.js
index d884b25..7a58f83 100644
--- a/phase3_execute.js
+++ b/phase3_execute.js
@@ -16,7 +16,7 @@ const fs = require('fs');
 const path = require('path');
 
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const API='/admin/api/2024-10/graphql.json';
 const OUT=__dirname;
 
diff --git a/phase3_legacy_renumber.js b/phase3_legacy_renumber.js
index 8d75ef6..b8f35e5 100644
--- a/phase3_legacy_renumber.js
+++ b/phase3_legacy_renumber.js
@@ -18,7 +18,7 @@ const fs = require('fs');
 const path = require('path');
 
 const STORE = 'designer-laboratory-sandbox.myshopify.com';
-const TOKEN = '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';
+const TOKEN = (process.env.SHOPIFY_ADMIN_TOKEN || '');
 const API   = '/admin/api/2024-10/graphql.json';
 const OUT   = __dirname;
 
diff --git a/phase3_prepare_jeffrey_stevens.js b/phase3_prepare_jeffrey_stevens.js
index 4c77dd2..d28a0fb 100644
--- a/phase3_prepare_jeffrey_stevens.js
+++ b/phase3_prepare_jeffrey_stevens.js
@@ -18,7 +18,7 @@ const fs = require('fs');
 const path = require('path');
 
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const API='/admin/api/2024-10/graphql.json';
 const OUT=__dirname;
 
diff --git a/phase3_prepare_v2.js b/phase3_prepare_v2.js
index b758d1e..77a5d83 100644
--- a/phase3_prepare_v2.js
+++ b/phase3_prepare_v2.js
@@ -14,7 +14,7 @@ const fs = require('fs');
 const path = require('path');
 
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const API='/admin/api/2024-10/graphql.json';
 const OUT=__dirname;
 
diff --git a/phase4_dwqw_collections.js b/phase4_dwqw_collections.js
index 063486d..a15cdad 100644
--- a/phase4_dwqw_collections.js
+++ b/phase4_dwqw_collections.js
@@ -19,7 +19,7 @@ const fs = require('fs');
 const path = require('path');
 
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const API='/admin/api/2024-10/graphql.json';
 const OUT=__dirname;
 const LOG = path.join(OUT, 'phase4_collections.log');
diff --git a/qty_backfill.js b/qty_backfill.js
index 9849459..36c1026 100644
--- a/qty_backfill.js
+++ b/qty_backfill.js
@@ -7,7 +7,7 @@ const https = require('https');
 const fs = require('fs');
 
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const LOG = '/Users/macstudio3/Projects/dwjs-consolidation-2026-04-23/qty_backfill.log';
 const log = m => { const l=`[${new Date().toISOString().slice(0,19)}] ${m}\n`; process.stdout.write(l); fs.appendFileSync(LOG,l); };
 
diff --git a/qty_coverage_audit.js b/qty_coverage_audit.js
index 86c3681..6cd84a3 100644
--- a/qty_coverage_audit.js
+++ b/qty_coverage_audit.js
@@ -3,7 +3,7 @@
 const https = require('https');
 const fs = require('fs');
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 
 function gql(b, retry=0){return new Promise((res,rej)=>{const d=JSON.stringify(b);const r=https.request({hostname:STORE,path:'/admin/api/2024-10/graphql.json',method:'POST',headers:{'X-Shopify-Access-Token':TOKEN,'Content-Type':'application/json','Content-Length':Buffer.byteLength(d)}},R=>{let c='';R.on('data',x=>c+=x);R.on('end',()=>{try{res(JSON.parse(c))}catch{if(retry<3)setTimeout(()=>res(gql(b,retry+1)),2000);else res({error:c.slice(0,300)})}})});r.on('error',err=>{if(retry<3)setTimeout(()=>res(gql(b,retry+1)),2000);else rej(err)});r.setTimeout(60000,()=>{r.destroy();if(retry<3)res(gql(b,retry+1));else rej(new Error('t'))});r.write(d);r.end()});}
 
diff --git a/reactivate.js b/reactivate.js
index 6d5ab64..8f660a7 100644
--- a/reactivate.js
+++ b/reactivate.js
@@ -6,7 +6,7 @@ const fs = require('fs');
 const { isProtected } = require('/Users/macstudio3/Projects/_shared/archive-guard');
 
 const STORE='designer-laboratory-sandbox.myshopify.com';
-const TOKEN='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';
+const TOKEN=(process.env.SHOPIFY_ADMIN_TOKEN || '');
 const LOG = '/Users/macstudio3/Projects/dwjs-consolidation-2026-04-23/reactivate.log';
 const log = m => { const l=`[${new Date().toISOString().slice(0,19)}] ${m}\n`; process.stdout.write(l); fs.appendFileSync(LOG,l); };
 
diff --git a/spin_detect_delete.js b/spin_detect_delete.js
index d6bbb72..73c780c 100644
--- a/spin_detect_delete.js
+++ b/spin_detect_delete.js
@@ -4,7 +4,7 @@
 const fs = require('fs');
 const path = require('path');
 const { execSync, spawn } = require('child_process');
-const TOKEN = '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';
+const TOKEN = (process.env.SHOPIFY_ADMIN_TOKEN || '');
 const SHOP = 'designer-laboratory-sandbox.myshopify.com';
 const API = `https://${SHOP}/admin/api/2024-10/graphql.json`;
 const STATE = '/tmp/hw_spin_state.ndjson';

← 2d8f74e chore: macstudio3 migration — reconcile from mac2 + repoint  ·  back to Dwjs Consolidation 2026 04 23  ·  (newest)