security: strip hardcoded secret -> env-first/passwordless. No rotation/deploy.

0b82d9db0a4a781ffd84ca147189408aa24a0cf3 · 2026-06-22 09:24:12 -0700 · Steve

Files touched

M server.js

Diff

commit 0b82d9db0a4a781ffd84ca147189408aa24a0cf3
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon Jun 22 09:24:12 2026 -0700

    security: strip hardcoded secret -> env-first/passwordless. No rotation/deploy.
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 20f9cf8..cdd1141 100644
--- a/server.js
+++ b/server.js
@@ -62,7 +62,7 @@ function localExec(cmd) {
 
 const pool = new Pool({
   host: '127.0.0.1', port: 5432, user: 'dw_admin',
-  password: process.env.PGPASSWORD || 'DW2024SecurePass', database: 'dw_unified',
+  password: process.env.PGPASSWORD || '', database: 'dw_unified',
 });
 
 app.use(express.json());

← 9768cb4 label intentional no-scrape vendors honestly: API exposes sk · back to Vendor Agents Viewer · harden va-* launcher: EADDRINUSE backoff binder + --kill-tim 52c61e1 →