security: strip hardcoded dw_admin DSN password -> env-first/passwordless. No rotation/deploy.

2f254cdf381b69ec10336a75e1b2ff3ffce2cd33 · 2026-05-30 09:49:20 -0700 · Steve

Files touched

M server.js

Diff

commit 2f254cdf381b69ec10336a75e1b2ff3ffce2cd33
Author: Steve <steve@designerwallcoverings.com>
Date:   Sat May 30 09:49:20 2026 -0700

    security: strip hardcoded dw_admin DSN password -> env-first/passwordless. No rotation/deploy.
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 588b73c..1827d55 100644
--- a/server.js
+++ b/server.js
@@ -21,7 +21,7 @@ const PORT = process.env.PORT || 9614;
 const AGENT_COLOR = '#F59E0B'; // Amber/Warning yellow
 const AGENT_NAME = 'Timeout Agent';
 
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:15432/dw_unified' });
+const pool = new Pool({ connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:15432/dw_unified') });
 
 const SLACK_WEBHOOK = 'https://hooks.slack.com/services/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';

← 60d0d08 add sort + density controls to process grid · back to Timeout Agent · fix: catch DB init failure so server boots in degraded mode; f16f517 →