[object Object]

← back to Jill Website

security: scrub hardcoded admin password from CLAUDE.md + add helmet dep

53b173b5eaa097aa796795350d9878f9c08c30d2 · 2026-05-11 10:25:08 -0700 · SteveStudio2

CLAUDE.md was committing the live admin password 'DWSecure2024!' as
plaintext doc — anyone who cloned the repo had prod credentials. Replaced
with a pointer to ADMIN_PASSWORD env var.

helmet was already require()'d in server.js but missing from
package.json/lock — npm install would fail cold. Adding it now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

Diff

commit 53b173b5eaa097aa796795350d9878f9c08c30d2
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Mon May 11 10:25:08 2026 -0700

    security: scrub hardcoded admin password from CLAUDE.md + add helmet dep
    
    CLAUDE.md was committing the live admin password 'DWSecure2024!' as
    plaintext doc — anyone who cloned the repo had prod credentials. Replaced
    with a pointer to ADMIN_PASSWORD env var.
    
    helmet was already require()'d in server.js but missing from
    package.json/lock — npm install would fail cold. Adding it now.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 CLAUDE.md          |  2 +-
 package-lock.json  | 10 ++++++++++
 package.json       |  1 +
 public/favicon.svg |  4 ++++
 4 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index baa1f5e..8077965 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,7 +4,7 @@
 
 - **URL**: http://45.61.58.125:8201
 - **Username**: admin
-- **Password**: DWSecure2024!
+- **Password**: (ADMIN_PASSWORD env — see project .env; no longer hardcoded)
 - **PM2 Name**: jill-website
 
 ## Project Overview
diff --git a/package-lock.json b/package-lock.json
index 9b50480..7ac1662 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -20,6 +20,7 @@
         "ejs": "^3.1.10",
         "express": "^4.18.2",
         "express-session": "^1.18.2",
+        "helmet": "^8.1.0",
         "multer": "^2.0.2",
         "nodemailer": "^7.0.12",
         "pg": "^8.16.3",
@@ -4871,6 +4872,15 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/helmet": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.1.0.tgz",
+      "integrity": "sha512-jOiHyAZsmnr8LqoPGmCjYAaiuWwjAPLgY8ZX2XrmHawt99/u1y6RgrZMTeoPfpUbV96HOalYgz1qzkRbw54Pmg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/html-escaper": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
diff --git a/package.json b/package.json
index 5df7687..6c2c1d1 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "ejs": "^3.1.10",
     "express": "^4.18.2",
     "express-session": "^1.18.2",
+    "helmet": "^8.1.0",
     "multer": "^2.0.2",
     "nodemailer": "^7.0.12",
     "pg": "^8.16.3",
diff --git a/public/favicon.svg b/public/favicon.svg
new file mode 100644
index 0000000..f33143b
--- /dev/null
+++ b/public/favicon.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+<rect width="32" height="32" rx="6" fill="#06b6d4"/>
+<text x="50%" y="55%" text-anchor="middle" dominant-baseline="middle" font-size="20" font-family="Apple Color Emoji, Segoe UI Emoji, sans-serif" fill="white">🌊</text>
+</svg>
\ No newline at end of file

← 6852df5 security: remove express.static('.') — was exposing .env ove  ·  back to Jill Website  ·  .gitignore: broaden to exclude snapshot/backup/swap files 6087759 →