[object Object]

← back to Hollywood Import

TK-11415: label the Momentum Meilisearch literal as a vendor-owned PUBLIC search key (not a secret, not ours to rotate)

8d08f311f2742fdc222c71d7dddb45c0411e05ba · 2026-09-10 11:32:49 -0700 · Steve Abrams

Files touched

Diff

commit 8d08f311f2742fdc222c71d7dddb45c0411e05ba
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 11:32:49 2026 -0700

    TK-11415: label the Momentum Meilisearch literal as a vendor-owned PUBLIC search key (not a secret, not ours to rotate)
---
 momentum-feed/price-backfill.mjs | 5 +++++
 momentum-feed/refresh.mjs        | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/momentum-feed/price-backfill.mjs b/momentum-feed/price-backfill.mjs
index f69a268..746936c 100644
--- a/momentum-feed/price-backfill.mjs
+++ b/momentum-feed/price-backfill.mjs
@@ -7,6 +7,11 @@ import { createRequire } from 'module';
 const require = createRequire(import.meta.url);
 const { Pool } = require('pg');
 const HOST = 'https://ms-e886719d86e7-4256.sfo.meilisearch.io';
+// NOT A SECRET — vendor-owned PUBLIC search key. Momentum ships this exact literal in
+// their own ANONYMOUS browser bundle (momentumco.com/build/assets/app-*.js) and it is
+// search-scoped only (GET /keys -> 403 invalid_api_key). We do NOT own the Meilisearch
+// account, so it is not ours to revoke or rotate. Do not route it through the secrets
+// manager and do not re-open it as a leak. Verified read-only 2026-09-10 — TK-11133/TK-11415.
 const KEY = process.env.MOMENTUM_MS_KEY || '95fe8376edc78d49e787db49edda68426b21649f6271f49e2f1412118612fbd6';
 const MARKUP = 1.448;
 const COMMIT = process.argv.includes('--commit');
diff --git a/momentum-feed/refresh.mjs b/momentum-feed/refresh.mjs
index dd7cf36..e3e652d 100644
--- a/momentum-feed/refresh.mjs
+++ b/momentum-feed/refresh.mjs
@@ -13,6 +13,11 @@ const { Pool } = require('pg');
 const HOST = 'https://ms-e886719d86e7-4256.sfo.meilisearch.io';
 // Search key is hardcoded in momentumco.com app.js (meta tag is a decoy). Re-grab if it rotates:
 //   curl -s .../build/assets/app-*.js | grep -oE 'initializeMeiliSearch\("https[^"]+","[0-9a-f]{64}"'
+// NOT A SECRET — vendor-owned PUBLIC search key. Momentum ships this exact literal in
+// their own ANONYMOUS browser bundle (momentumco.com/build/assets/app-*.js) and it is
+// search-scoped only (GET /keys -> 403 invalid_api_key). We do NOT own the Meilisearch
+// account, so it is not ours to revoke or rotate. Do not route it through the secrets
+// manager and do not re-open it as a leak. Verified read-only 2026-09-10 — TK-11133/TK-11415.
 const KEY = process.env.MOMENTUM_MS_KEY || '95fe8376edc78d49e787db49edda68426b21649f6271f49e2f1412118612fbd6';
 const INDEX = 'redesign-colors';
 const KEEP = new Set(['Wallcovering', 'Acoustic']);

← 3c85ec7 Hollywood generator: positive SKU shape-guard at write choke  ·  back to Hollywood Import  ·  TK-11337: promote Dana Point Split Rock residual to per-yard 8fa9801 →