Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice

eb911f07eb4147c6733aa11f0052634606b2fe4a · 2026-07-16 09:59:12 -0700 · Steve Abrams

Files touched

M SECURITY-HOLD.md
M server.js

Diff

commit eb911f07eb4147c6733aa11f0052634606b2fe4a
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:59:12 2026 -0700

    Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice
---
 SECURITY-HOLD.md | 2 +-
 server.js        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/SECURITY-HOLD.md b/SECURITY-HOLD.md
index 9e72e2f..9161e41 100644
--- a/SECURITY-HOLD.md
+++ b/SECURITY-HOLD.md
@@ -3,7 +3,7 @@
 This repository contains a LIVE Shopify Admin API token committed at
 `server.js:189`:
 
-  const TOKEN = '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'
+  const TOKEN = 'shpat_REDACTED'
 
 The token targets the **designer-laboratory-sandbox** store, which per
 MEMORY.md is the LIVE production Designer Wallcoverings storefront
diff --git a/server.js b/server.js
index 54d7087..51c6abb 100644
--- a/server.js
+++ b/server.js
@@ -194,7 +194,7 @@ app.get('/api/decisions/export', (req, res) => {
 });
 
 // ===== APPLY pipeline =====
-const TOKEN = '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';
+const TOKEN = (process.env.SHOPIFY_ADMIN_TOKEN || '');
 const SHOP = 'designer-laboratory-sandbox.myshopify.com';
 const SHOPIFY_API = `https://${SHOP}/admin/api/2024-10/graphql.json`;
 const APPLY_LOG = '/tmp/mfr_apply_log.ndjson';

← 942d742 SECURITY HOLD — live Shopify shpat_ token committed at serve · back to Mfr Review Viewer · (newest)