security: strip hardcoded dw_admin DSN password -> env-first. No rotation/deploy.

008f261ebbde2c549264f18b68e4c7498c613d6c · 2026-05-30 09:32:49 -0700 · steve

Files touched

M server.js

Diff

commit 008f261ebbde2c549264f18b68e4c7498c613d6c
Author: steve <steve@designerwallcoverings.com>
Date:   Sat May 30 09:32:49 2026 -0700

    security: strip hardcoded dw_admin DSN password -> env-first. No rotation/deploy.
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 01f8553..9cff179 100644
--- a/server.js
+++ b/server.js
@@ -12,7 +12,7 @@ const PORT = process.env.PORT || 9894;
 const AGENT_COLOR = '#84CC16'; // Lime
 
 const pool = new Pool({
-  connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/dw_unified'
+  connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:5432/dw_unified')
 });
 
 const SHOPIFY_TOKEN = process.env.SHOPIFY_ADMIN_TOKEN;

← 46a693f ui: add rel=noopener noreferrer to all target=_blank anchors · back to Sku Check Skill · fix: read GEMINI_API_KEY from process.env instead of literal 1c12bfb →