Security: remove browser-shipped basic-auth password from client boot-error (was the now-rotated DWMarketing2026!) — gitleaks-flagged browser-shipped cred in public/app.js

de6eb5fd1dbcb1ede0728535ca22d06d7487d375 · 2026-06-16 07:22:00 -0700 · SteveStudio2

Files touched

M public/app.js

Diff

commit de6eb5fd1dbcb1ede0728535ca22d06d7487d375
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Tue Jun 16 07:22:00 2026 -0700

    Security: remove browser-shipped basic-auth password from client boot-error (was the now-rotated DWMarketing2026!) — gitleaks-flagged browser-shipped cred in public/app.js
---
 public/app.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/app.js b/public/app.js
index 7799c2f..377b9eb 100644
--- a/public/app.js
+++ b/public/app.js
@@ -66,7 +66,7 @@ function renderBootError(e) {
        <h2>Couldn't load the dashboard</h2>
        <p class="muted">${e.message || e}</p>
        <p class="muted" style="font-size:12.5px">If this is an auth error, reload the page once and enter
-         <b>admin</b> / <b>DWMarketing2026!</b> in the browser dialog, then it will stick.</p>
+         your MCC credentials in the browser dialog, then it will stick.</p>
        <button class="btn gold" onclick="boot()">Retry</button>
      </div>`;
 }

← ad0fc2a Add META token health canary (Council #4): GET /me liveness · back to Marketing Command Center · meta-token-health: fix dead George alert URL (HTTPS flip 202 fe2afd8 →