fail-open guardrail: warn at boot when admin auth is unconfigured (TK-10984 opt-A)

f7d58231b24f2978104af6c2995e916bf9a43191 · 2026-08-31 00:00:08 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit f7d58231b24f2978104af6c2995e916bf9a43191
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Aug 31 00:00:08 2026 -0700

    fail-open guardrail: warn at boot when admin auth is unconfigured (TK-10984 opt-A)
---
 server.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server.js b/server.js
index 2db7f6c..7a0d413 100644
--- a/server.js
+++ b/server.js
@@ -254,4 +254,5 @@ http.createServer((req, res) => {
   console.log('  Admin: http://localhost:' + this.address().port + '/admin');
   if (BASIC_AUTH) console.log('  Site auth: ' + BASIC_AUTH.split(':')[0] + ':***');
   if (ADMIN_AUTH) console.log('  Admin auth: ' + ADMIN_AUTH.split(':')[0] + ':***');
+  if (!ADMIN_AUTH) console.warn('[reno-visualizer] ⚠️  ADMIN OPEN — no ADMIN_AUTH/BASIC_AUTH; /admin is UNGATED. Set BASIC_AUTH before any public deploy. (TK-10984)');
 });

← 731617f add creds-in-URL fetch guard to gated pages (TK-10984) · back to Reno Visualizer · (newest)