security: strip hardcoded dw_admin DSN password -> env-first/passwordless. No rotation/deploy.

73ea192100aa96fc8f9e3fe1d5d0da24994df761 · 2026-05-30 09:49:20 -0700 · Steve

Files touched

M create-vendor-pages.js
M server.js

Diff

commit 73ea192100aa96fc8f9e3fe1d5d0da24994df761
Author: Steve <steve@designerwallcoverings.com>
Date:   Sat May 30 09:49:20 2026 -0700

    security: strip hardcoded dw_admin DSN password -> env-first/passwordless. No rotation/deploy.
---
 create-vendor-pages.js | 2 +-
 server.js              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/create-vendor-pages.js b/create-vendor-pages.js
index 2850574..3ae67b8 100644
--- a/create-vendor-pages.js
+++ b/create-vendor-pages.js
@@ -11,7 +11,7 @@ const https = require('https');
 const SHOPIFY_DOMAIN = 'designer-laboratory-sandbox.myshopify.com';
 const SHOPIFY_TOKEN = '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';
 const API_VERSION = '2024-01';
-const DB_URL = 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:15432/dw_unified';
+const DB_URL = (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:15432/dw_unified');
 
 // Vendors that already have pages (will also be checked dynamically)
 const SKIP_HANDLES = new Set([
diff --git a/server.js b/server.js
index a279605..8fe01d3 100644
--- a/server.js
+++ b/server.js
@@ -10,7 +10,7 @@ app.use(helmet({ contentSecurityPolicy: false }));
 const PORT = 9860;
 
 const pool = new Pool({
-  connectionString: 'postgresql://dw_admin:DW2024SecurePass@127.0.0.1:15432/dw_unified'
+  connectionString: (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:15432/dw_unified')
 });
 
 app.use(express.json());

← 1eaaf46 harden static root: 404-guard .bak/.pre- paths + broaden git · back to Vendor Discount Agent · fix: populate discount_found field in check record when disc 59c40d4 →