`SECURITY-HOLD.md`

34 lines
# SECURITY HOLD — 2026-05-19 (session #88 Green, tick 152)

This repository contains a LIVE Shopify Admin API token committed at
`server.js:189`:

  const TOKEN = 'shpat_REDACTED'

The token targets the **designer-laboratory-sandbox** store, which per
MEMORY.md is the LIVE production Designer Wallcoverings storefront
(NOT a sandbox despite the name). The token has product mutate +
delete permissions.

Per Steve's standing debate-team verdict on leaked credentials:

1. **Rotate the token FIRST** at Shopify admin
   (https://admin.shopify.com/store/designer-laboratory-sandbox/apps/private — disable/delete the credential).
2. Then update source: move to gitignored `.env` (SHOPIFY_ADMIN_TOKEN),
   add `.env.example` template, replace the hardcoded literal with
   `process.env.SHOPIFY_ADMIN_TOKEN`.
3. **Do NOT** simply git-rm and amend — the token will remain in
   history. The rotate-at-Shopify step is the mitigation, not the
   commit edit.

Until rotated + replaced, this repo is SUSPENDED from the
fleet-refactor-sweep. No further mechanical passes will run against
it until this file is removed by Steve.

Also unconfigured in this repo:
- Basic-auth password (`DWSecure2024!`) hardcoded at line 15-16 — should
  be env-overridable via BASIC_AUTH.
- PORT mismatch: line 14 says 9871, docstring line 2 says 9870.
- Reads from `/tmp/*.ndjson` + `/tmp/*.json` — works on macOS but not
  Linux/Kamatera (tmp clears on reboot).