← back to Security Dashboard

dashboard: mark 3 leaks env-ified (code closed; still rotate), mfr held on SECURITY-HOLD; rotate-vs-envify status pills

cf95d58a13a9c61e07dcf218c656f463d69b7913 · 2026-05-31 17:21:19 -0700 · SteveStudio2

Files touched

• M data/code-leaks.json
• M public/index.html

Diff

commit cf95d58a13a9c61e07dcf218c656f463d69b7913
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sun May 31 17:21:19 2026 -0700

    dashboard: mark 3 leaks env-ified (code closed; still rotate), mfr held on SECURITY-HOLD; rotate-vs-envify status pills
---
 data/code-leaks.json | 12 ++++++++----
 public/index.html    |  4 ++--
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/data/code-leaks.json b/data/code-leaks.json
index 1298932..20e5e66 100644
--- a/data/code-leaks.json
+++ b/data/code-leaks.json
@@ -10,7 +10,8 @@
       "line": 197,
       "scope": "LIVE store designer-laboratory-sandbox · MUTATE+DELETE",
       "regen_url": "https://admin.shopify.com/store/designer-laboratory-sandbox/settings/apps/development",
-      "note": "Has its own SECURITY-HOLD.md; rotate FIRST, then delete that file to un-suspend the repo."
+      "envified": false,
+      "note": "UNTOUCHED — SECURITY-HOLD.md gates this repo. Rotate the Shopify token FIRST, then delete SECURITY-HOLD.md to un-suspend + let secret-strip env-ify it."
     },
     {
       "severity": "high",
@@ -21,7 +22,8 @@
       "line": 9,
       "scope": "TTS account · billable",
       "regen_url": "https://elevenlabs.io/app/settings/api-keys",
-      "note": "Same repo carried the /var/tmp/.font/n0de malware — treat as compromised."
+      "envified": true,
+      "note": "Code env-ified ✓ 2026-05-31 (ecosystem.config.js + 2 docs + voice-monitor.sh, 4 copies removed). STILL ROTATE — key remains in git history; same repo carried the n0de malware (now clean), treat as compromised."
     },
     {
       "severity": "medium",
@@ -32,7 +34,8 @@
       "line": 15,
       "scope": "info-inbox basic-auth",
       "regen_url": "",
-      "note": "Move GEORGE_AUTH to env; part of global DWSecure2024! rotation."
+      "envified": true,
+      "note": "Code env-ified ✓ 2026-05-31 (now requires GEORGE_AUTH from env, fails loud if unset). Part of the global DWSecure2024! rotation."
     },
     {
       "severity": "medium",
@@ -43,7 +46,8 @@
       "line": 20,
       "scope": "admin login default",
       "regen_url": "",
-      "note": "Remove literal default; require COMPLIANCE_ADMIN_PASS at boot."
+      "envified": true,
+      "note": "Code env-ified ✓ 2026-05-31 (literal default removed; random per-boot secret if COMPLIANCE_ADMIN_PASS unset — admin login disabled-by-default, no bypass). Part of the global DWSecure2024! rotation."
     }
   ],
   "malware": {
diff --git a/public/index.html b/public/index.html
index d0da165..555035b 100644
--- a/public/index.html
+++ b/public/index.html
@@ -195,8 +195,8 @@ function render(d){
       <td>${x.service}<div class="mut mono" style="font-weight:400;font-size:11px">${x.scope||''}</div></td>
       <td class="mono">…${x.last4}</td>
       <td><a class="mono" href="${editLink(x)}" title="open in VS Code at line ${x.line}">${x.project}/${x.file_abs.split('/').pop()}:${x.line}</a></td>
-      <td>${pill(sevcls[x.severity]||'info', x.severity)}</td>
-      <td>${x.regen_url?`<a href="${x.regen_url}" target="_blank" rel="noopener noreferrer">regen ↗</a>`:`<span class="mut" style="font-size:11px">env-ify</span>`}</td></tr>`).join('')}
+      <td>${pill(sevcls[x.severity]||'info', x.severity)}${x.envified?' '+pill('ok','env-ified'):' '+pill('warn','code open')}</td>
+      <td>${x.regen_url?`<a href="${x.regen_url}" target="_blank" rel="noopener noreferrer">rotate ↗</a>`:`<span class="mut" style="font-size:11px">${x.envified?'rotate pw':'env-ify'}</span>`}</td></tr>`).join('')}
     </table>
     ${leaks.map(x=>x.note?`<div class="note">• <b class="mono">${x.project}</b> — ${x.note}</div>`:'').join('')}
     ${m?`<div class="banner bad" style="margin-top:12px"><span class="pill ${m.status&&m.status.indexOf('removed')>=0?'ok':'bad'}"><i class="dot"></i>🦠 malware</span>

← c5b2a58 auto-surface live tokens also hardcoded in code to top of ro  ·  back to Security Dashboard  ·  prod-ready: env PORT + PROBE_LOCAL on-box probe mode, /api/h 3b1fd39 →