redact vendor names from customer-facing /api (close fleet leak)

19eb6460cf5d843cfca15bbc3f146a9061a1cd56 · 2026-05-26 09:45:04 -0700 · Steve

Files touched

M server.js

Diff

commit 19eb6460cf5d843cfca15bbc3f146a9061a1cd56
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 26 09:45:04 2026 -0700

    redact vendor names from customer-facing /api (close fleet leak)
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 81e7431..e5e8d5a 100644
--- a/server.js
+++ b/server.js
@@ -33,7 +33,7 @@ async function getProducts() {
     `);
     // Apply brand-scrub to text fields
     for (const r of rows) {
-      r.vendor = brandScrub(r.vendor);
+      r.vendor = BRAND_NAME;  // full redaction: never expose real supplier names (brandScrub only caught the "Designer Wallcoverings" string, real vendors like "Maya Romanoff" leaked)
       r.imageAlt = brandScrub(r.imageAlt);
       r.description = brandScrub(r.description);
       r.title = brandScrub(r.title);

← fea16fb add: pre-stage Meta Pixel snippet (placeholder; flip via _dw · back to Glassbeadedwallpaper · glass: make sort+density controls functional c1d4d44 →