`CHANGES.md`

20 lines

## Applied
- `server.py:23` — removed hardcoded Spoonflower credential defaults and now fails fast when `SPOONFLOWER_EMAIL` or `SPOONFLOWER_PASSWORD` is missing — prevents source fallback secrets.
- `server.py:18`, `server.py:66`, `server.py:154`, `server.py:197`, `server.py:226` — replaced hardcoded `/root/.claude/skills/resize-it` subprocess cwd values with `Path(__file__).resolve().parent` — makes scripts run from this checkout.
- `server.py:119`, `server.py:174` — replaced `request.json` with `request.get_json(silent=True)` plus a 400 response for missing or malformed JSON — avoids 500s on bad request bodies.
- `server.py:291` — changed advertised URL to localhost — removes public-IP guidance for a local tool.
- `server.py:292` — changed Flask bind from `0.0.0.0`/`debug=True` to `127.0.0.1`/`debug=False` — avoids exposing the debug server.
- `SKILL.md:89` — replaced embedded Gemini API key with `process.env.GEMINI_API_KEY` and a fail-fast check — removes the secret from docs/source.
- `.env.example:1` — added placeholder environment variables for Spoonflower credentials and Gemini API key — documents required configuration without storing real secrets.

## Deferred (needs Steve)
- P0 — `.env:1` — real Spoonflower credentials may still exist locally — deferred because `.env` was explicitly left untouched and real credentials must be rotated by Steve.
- P0 — `SKILL.md:89` — exposed Gemini API key needs revocation and history scrubbing if shared — source was cleaned, but rotation/history cleanup needs Steve.
- P0 — `server.py:41`, `server.py:115`, `server.py:170` — no auth on local API endpoints that can use stored credentials — deferred because auth design/token ownership is outside the safe fix list.
- P0 — `server.py:183` — Spoonflower URL validation is substring-only — deferred because stronger host validation was not in the safe fix list.
- P0 — `server.py:208` — newest-image selection from global `/tmp` can cross requests — deferred because request-scoped temp workflow changes are broader than safe surgical fixes.
- P1 — `server.py:52` — uploaded files can overwrite the same sanitized filename — deferred because filename/session behavior was not in the safe fix list.
- P1 — `server.py:277` — download route can expose matching files in `/tmp` — deferred because allowlist/session mapping is a broader behavior change.
- P1 — `scripts/spoonflower_full_workflow.py:201` — upload success is inferred after sleep/screenshot — deferred because adding confirmed save-state assertions needs workflow testing.
- P1 — `web-interface.html:263` — frontend reads `error.message` while server returns `error` — deferred because public-facing HTML changes were out of scope.