sync-tokens: strip hardcoded password fallback (was leaked in git)

37b29cb2f4c4249e4ff9e1b69e24f55af2165119 · 2026-05-06 12:12:45 -0700 · Steve Abrams

The literal value '149940c2c5b209fb' was previously the OR-fallback when BC_PASS env was missing — meaning anyone with the repo had Steve's prod password. Now fail-closed: BC_PASS env required at runtime, script exits 1 with clear message if missing. Existing launchd plist already passes the env, so no functional change for the hot path.

NOTE for daylight Steve: rotate the prod password since the old one is in git history.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M scripts/sync-tokens.js

Diff

commit 37b29cb2f4c4249e4ff9e1b69e24f55af2165119
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed May 6 12:12:45 2026 -0700

    sync-tokens: strip hardcoded password fallback (was leaked in git)
    
    The literal value '149940c2c5b209fb' was previously the OR-fallback when BC_PASS env was missing — meaning anyone with the repo had Steve's prod password. Now fail-closed: BC_PASS env required at runtime, script exits 1 with clear message if missing. Existing launchd plist already passes the env, so no functional change for the hot path.
    
    NOTE for daylight Steve: rotate the prod password since the old one is in git history.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 scripts/sync-tokens.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/sync-tokens.js b/scripts/sync-tokens.js
index 462b07c..d643956 100755
--- a/scripts/sync-tokens.js
+++ b/scripts/sync-tokens.js
@@ -10,7 +10,8 @@ const os = require("os");
 
 const PROD  = process.env.BC_URL  || "https://venturaclaw.com";
 const EMAIL = process.env.BC_USER || "steve@venturaclaw.com";
-const PASS  = process.env.BC_PASS || "149940c2c5b209fb";
+const PASS  = process.env.BC_PASS;
+if (!PASS) { console.error("FATAL: BC_PASS env var required (was hardcoded as a fallback — leaked in git history; rotate)"); process.exit(1); }
 const LOG   = path.join(os.homedir(), "Projects", "ventura-claw", "logs", "sync.log");
 fs.mkdirSync(path.dirname(LOG), { recursive: true });
 const log = (m) => { const line = `[${new Date().toISOString()}] ${m}\n`; fs.appendFileSync(LOG, line); process.stdout.write(line); };

← 817b756 no breakins: pull plaintext creds from login banner, add PUT · back to Ventura Claw · chat: surface Admin link in topbar for admin users 5b582d2 →