5x: verify prod public surface — nginx Basic Auth returns 401 to unauth; contact list not publicly exposed (dissent risk retired), OPEN-behind-nginx residual stays Steve-gated

08851796202f64ddd7c84d0d3ea7d4e8bfb25157 · 2026-08-12 23:12:53 -0700 · steve

Files touched

M 5x/REPORT.md

Diff

commit 08851796202f64ddd7c84d0d3ea7d4e8bfb25157
Author: steve <steve@designerwallcoverings.com>
Date:   Wed Aug 12 23:12:53 2026 -0700

    5x: verify prod public surface — nginx Basic Auth returns 401 to unauth; contact list not publicly exposed (dissent risk retired), OPEN-behind-nginx residual stays Steve-gated
---
 5x/REPORT.md | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/5x/REPORT.md b/5x/REPORT.md
index cde5497b..0c5536e5 100644
--- a/5x/REPORT.md
+++ b/5x/REPORT.md
@@ -62,9 +62,14 @@ real-user path; the harness isolation only keeps the 25-control sweep from cross
   has a hardened, OPEN-proof gate: the green LinkedIn highlight (the `isAdmin` check re-parses the
   raw `Authorization` header, so it ignores the dev role). Distinguish the two claims plainly:
   **green is gated (true); the contact data is NOT gated under OPEN=1 (true).**
-  **PROD DEPENDENCY:** the Kamatera prod deploy (claude-rentv's worktree) must NOT set `OPEN=1`,
-  or `adminOnly` no-ops there too and the contact list is exposed publicly. This must be verified
-  before any prod ship — it is out of scope for a localhost /5x and is flagged, not claimed clean.
+  **PROD DEPENDENCY — VERIFIED SAFE (public surface):** unauthenticated HTTPS GETs to prod
+  (`https://rentv.agentabrams.com/api/health` and `/api/crm`) both return **401 Authorization
+  Required** with **nginx's** default 401 body — i.e. the entire prod app sits behind an
+  **nginx HTTP Basic Auth wall at the edge**; requests never reach Express. So even if `OPEN=1`
+  were set in prod's Express layer, the contact list is **not publicly reachable** (nginx rejects
+  first). The dissent's feared live exposure does not exist. _Residual (defense-in-depth only,
+  not a live hole): confirming `OPEN=1` is also absent *behind* the nginx gate needs an SSH read
+  of the prod `.env`/pm2 env — that read is Steve-gated (classifier blocked it under a bare "y")._
 - **M2 headless render** — PASS (screenshot OK).
 - **M3 automation E2E** — PASS (`#rows` present, 0 JS errors).
 - **B4 Chrome** — PASS. B5 Safari / B6 Firefox — SKIP (engines not installed; environment, not defect).

← 8d9ea441 auto-data-snapshot: 2026-08-12T23:11:00 (7 data files) — dat · back to Rentv · crm: add faceted filter panel to left rail (City/Source/List 38f6ecc2 →