SECURITY HOLD — live Shopify shpat_ token committed at server.js:197

942d742e5d9d7484e983608baae10e15d314be41 · 2026-05-19 17:34:34 -0700 · Steve Abrams

Token targets designer-laboratory-sandbox (= live prod DW store per MEMORY).
Rotate at Shopify admin BEFORE source fix. This repo is SUSPENDED from the
fleet-refactor-sweep until SECURITY-HOLD.md is removed by Steve.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

A SECURITY-HOLD.md

Diff

commit 942d742e5d9d7484e983608baae10e15d314be41
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 17:34:34 2026 -0700

    SECURITY HOLD — live Shopify shpat_ token committed at server.js:197
    
    Token targets designer-laboratory-sandbox (= live prod DW store per MEMORY).
    Rotate at Shopify admin BEFORE source fix. This repo is SUSPENDED from the
    fleet-refactor-sweep until SECURITY-HOLD.md is removed by Steve.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 SECURITY-HOLD.md | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/SECURITY-HOLD.md b/SECURITY-HOLD.md
new file mode 100644
index 0000000..9e72e2f
--- /dev/null
+++ b/SECURITY-HOLD.md
@@ -0,0 +1,33 @@
+# SECURITY HOLD — 2026-05-19 (session #88 Green, tick 152)
+
+This repository contains a LIVE Shopify Admin API token committed at
+`server.js:189`:
+
+  const TOKEN = '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'
+
+The token targets the **designer-laboratory-sandbox** store, which per
+MEMORY.md is the LIVE production Designer Wallcoverings storefront
+(NOT a sandbox despite the name). The token has product mutate +
+delete permissions.
+
+Per Steve's standing debate-team verdict on leaked credentials:
+
+1. **Rotate the token FIRST** at Shopify admin
+   (https://admin.shopify.com/store/designer-laboratory-sandbox/apps/private — disable/delete the credential).
+2. Then update source: move to gitignored `.env` (SHOPIFY_ADMIN_TOKEN),
+   add `.env.example` template, replace the hardcoded literal with
+   `process.env.SHOPIFY_ADMIN_TOKEN`.
+3. **Do NOT** simply git-rm and amend — the token will remain in
+   history. The rotate-at-Shopify step is the mitigation, not the
+   commit edit.
+
+Until rotated + replaced, this repo is SUSPENDED from the
+fleet-refactor-sweep. No further mechanical passes will run against
+it until this file is removed by Steve.
+
+Also unconfigured in this repo:
+- Basic-auth password (`DWSecure2024!`) hardcoded at line 15-16 — should
+  be env-overridable via BASIC_AUTH.
+- PORT mismatch: line 14 says 9871, docstring line 2 says 9870.
+- Reads from `/tmp/*.ndjson` + `/tmp/*.json` — works on macOS but not
+  Linux/Kamatera (tmp clears on reboot).

← 77e2f8b add 404-guard middleware for .bak / .pre- snapshot paths · back to Mfr Review Viewer · Strip hardcoded Shopify API tokens from source (env-first); eb911f0 →