[object Object]

← back to Tk 11331 Exec

TK-11415: label the Momentum Meilisearch literal as a vendor-owned PUBLIC search key (not a secret, not ours to rotate)

497b463344193e79a395483c5fe7db5f56c7522e · 2026-09-10 11:32:49 -0700 · Steve Abrams

Files touched

Diff

commit 497b463344193e79a395483c5fe7db5f56c7522e
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 11:32:49 2026 -0700

    TK-11415: label the Momentum Meilisearch literal as a vendor-owned PUBLIC search key (not a secret, not ours to rotate)
---
 d3c_stage.mjs                   | 5 +++++
 scripts/scrape_momentum_feed.py | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/d3c_stage.mjs b/d3c_stage.mjs
index 2eb41cc..59fbde0 100644
--- a/d3c_stage.mjs
+++ b/d3c_stage.mjs
@@ -26,6 +26,11 @@ const RESULTS = path.join(HERE, 'data', 'd3c-stage-results.json');
 const COMMIT = process.argv.includes('--commit');
 
 const HOST = 'https://ms-e886719d86e7-4256.sfo.meilisearch.io';
+// NOT A SECRET — vendor-owned PUBLIC search key. Momentum ships this exact literal in
+// their own ANONYMOUS browser bundle (momentumco.com/build/assets/app-*.js) and it is
+// search-scoped only (GET /keys -> 403 invalid_api_key). We do NOT own the Meilisearch
+// account, so it is not ours to revoke or rotate. Do not route it through the secrets
+// manager and do not re-open it as a leak. Verified read-only 2026-09-10 — TK-11133/TK-11415.
 const KEY = process.env.MOMENTUM_MS_KEY || '95fe8376edc78d49e787db49edda68426b21649f6271f49e2f1412118612fbd6';
 const INDEX = 'redesign-colors';
 const CAT_IDS = [1, 2, 3, 4, 5, 6, 7, 8];
diff --git a/scripts/scrape_momentum_feed.py b/scripts/scrape_momentum_feed.py
index d63441c..b5eec93 100644
--- a/scripts/scrape_momentum_feed.py
+++ b/scripts/scrape_momentum_feed.py
@@ -17,6 +17,11 @@ OUTPUT: data/momentum_feed_full.tsv  (tab-separated, one row per colorway)
 import json, os, time, urllib.request
 
 HOST = "https://ms-e886719d86e7-4256.sfo.meilisearch.io"
+# NOT A SECRET — vendor-owned PUBLIC search key. Momentum ships this exact literal in
+# their own ANONYMOUS browser bundle (momentumco.com/build/assets/app-*.js) and it is
+# search-scoped only (GET /keys -> 403 invalid_api_key). We do NOT own the Meilisearch
+# account, so it is not ours to revoke or rotate. Do not route it through the secrets
+# manager and do not re-open it as a leak. Verified read-only 2026-09-10 — TK-11133/TK-11415.
 KEY  = os.environ.get("MOMENTUM_MS_KEY",
         "95fe8376edc78d49e787db49edda68426b21649f6271f49e2f1412118612fbd6")
 INDEX = "redesign-colors"

← e43e633 auto-data-snapshot: 2026-09-10T05:23:03 (2 data files) — dat  ·  back to Tk 11331 Exec  ·  auto-data-snapshot: 2026-09-10T11:43:04 (1 data files) — scr cfeb030 →