TK-11415: label the Momentum Meilisearch literal as a vendor-owned PUBLIC search key (not a secret, not ours to rotate)

bc898f738706099a6b8c6b47f2efc0e48a859485 · 2026-09-10 11:32:49 -0700 · Steve Abrams

Files touched

M build_524_split.py
M split_analysis.py

Diff

commit bc898f738706099a6b8c6b47f2efc0e48a859485
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 11:32:49 2026 -0700

    TK-11415: label the Momentum Meilisearch literal as a vendor-owned PUBLIC search key (not a secret, not ours to rotate)
---
 build_524_split.py | 5 +++++
 split_analysis.py  | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/build_524_split.py b/build_524_split.py
index 0a8cf39..c06f758 100644
--- a/build_524_split.py
+++ b/build_524_split.py
@@ -14,6 +14,11 @@ sys.path.insert(0, "lib")
 from shopify import gql
 
 HI = os.path.expanduser("~/Projects/hollywood-import")
+# NOT A SECRET — vendor-owned PUBLIC search key. Momentum ships this exact literal in
+# their own ANONYMOUS browser bundle (momentumco.com/build/assets/app-*.js) and it is
+# search-scoped only (GET /keys -> 403 invalid_api_key). We do NOT own the Meilisearch
+# account, so it is not ours to revoke or rotate. Do not route it through the secrets
+# manager and do not re-open it as a leak. Verified read-only 2026-09-10 — TK-11133/TK-11415.
 KEY = "95fe8376edc78d49e787db49edda68426b21649f6271f49e2f1412118612fbd6"
 HOST = "https://ms-e886719d86e7-4256.sfo.meilisearch.io"
 MARKUP = 1.448
diff --git a/split_analysis.py b/split_analysis.py
index 81be43b..a915cd9 100644
--- a/split_analysis.py
+++ b/split_analysis.py
@@ -13,6 +13,11 @@ sys.path.insert(0, "lib")
 from shopify import gql
 
 HOST = "https://ms-e886719d86e7-4256.sfo.meilisearch.io"; INDEX = "redesign-colors"
+# NOT A SECRET — vendor-owned PUBLIC search key. Momentum ships this exact literal in
+# their own ANONYMOUS browser bundle (momentumco.com/build/assets/app-*.js) and it is
+# search-scoped only (GET /keys -> 403 invalid_api_key). We do NOT own the Meilisearch
+# account, so it is not ours to revoke or rotate. Do not route it through the secrets
+# manager and do not re-open it as a leak. Verified read-only 2026-09-10 — TK-11133/TK-11415.
 KEY = "95fe8376edc78d49e787db49edda68426b21649f6271f49e2f1412118612fbd6"
 HI = os.path.expanduser("~/Projects/hollywood-import")
 MARKUP = 1.448

← 6afcc0d auto-data-snapshot: 2026-08-30T23:23:51 (9 data files) — __p · back to Hollywood Price 2026 · auto-data-snapshot: 2026-09-10T11:43:04 (2 data files) — __p 681c9a6 →