Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice

d104f24b06fbe04e0b1342d76a62a7622601e895 · 2026-07-16 09:59:12 -0700 · Steve Abrams

Files touched

M create-vendor-pages.js

Diff

commit d104f24b06fbe04e0b1342d76a62a7622601e895
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:59:12 2026 -0700

    Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice
---
 create-vendor-pages.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/create-vendor-pages.js b/create-vendor-pages.js
index 3ae67b8..4a0b5d6 100644
--- a/create-vendor-pages.js
+++ b/create-vendor-pages.js
@@ -9,7 +9,7 @@ const { Client } = require('pg');
 const https = require('https');
 
 const SHOPIFY_DOMAIN = 'designer-laboratory-sandbox.myshopify.com';
-const SHOPIFY_TOKEN = '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';
+const SHOPIFY_TOKEN = (process.env.SHOPIFY_ADMIN_TOKEN || '');
 const API_VERSION = '2024-01';
 const DB_URL = (process.env.DATABASE_URL || 'postgresql://dw_admin@127.0.0.1:15432/dw_unified');

← 59c40d4 fix: populate discount_found field in check record when disc · back to Vendor Discount Agent · (newest)