security: strip DB DSN passwords from audit/digest docs (user@host form)

52ea65f0f4ec8214df83dc5e90d1f7b7a2b2a770 · 2026-06-09 17:29:41 -0700 · Steve Abrams
Files touched

M data/hardcoded-secrets-audit-20260530.md
M data/yolo-overnight/MORNING-DIGEST-2026-05-25.md
M data/yolo-overnight/SUMMARY-20260525.md
M data/yolo-overnight/frame-overlay-20260525-2350.md
M data/yolo-overnight/log-errors-20260525-1058.md
Diff

commit 52ea65f0f4ec8214df83dc5e90d1f7b7a2b2a770
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Jun 9 17:29:41 2026 -0700

    security: strip DB DSN passwords from audit/digest docs (user@host form)
---
 data/hardcoded-secrets-audit-20260530.md           | 8 ++++----
 data/yolo-overnight/MORNING-DIGEST-2026-05-25.md   | 2 +-
 data/yolo-overnight/SUMMARY-20260525.md            | 2 +-
 data/yolo-overnight/frame-overlay-20260525-2350.md | 2 +-
 data/yolo-overnight/log-errors-20260525-1058.md    | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/data/hardcoded-secrets-audit-20260530.md b/data/hardcoded-secrets-audit-20260530.md
index f636a42..995b39e 100644
--- a/data/hardcoded-secrets-audit-20260530.md
+++ b/data/hardcoded-secrets-audit-20260530.md
@@ -29,7 +29,7 @@ These are real, currently-active provider credentials baked into tracked source
 | 10 | `ventura-claw/server/data/credentials.json:5`                          | GoDaddy API secret                       | `…iVnej`   | NO (gitignored) | n/a |
 | 11 | `ventura-claw/server/data/credentials.json:10`                         | Browserbase live key (`bb_live_…`)        | `…cplOB8`  | NO (gitignored) | n/a |
 | 12 | `ventura-claw/server/data/credentials.json:16`                         | Cloudflare API token (`cfut_…`)           | `…700`     | NO (gitignored) | n/a |
-| 13 | `Designer-Wallcoverings/scripts/batch-room-generator.py:25`            | Postgres DSN `dw_admin:DW2024SecurePass` | `…ePass`   | YES | no |
+| 13 | `Designer-Wallcoverings/scripts/batch-room-generator.py:25`            | Postgres DSN `dw_admin:«REDACTED-DB-PW»` | `…ePass`   | YES | no |
 | 14 | `Designer-Wallcoverings/scripts/batch-room-settings.py:20`             | same DSN                                 | `…ePass`   | YES | no |
 | 15 | `Designer-Wallcoverings/DW-Programming/phase3-ai-enrich-batch.py:17`   | same DSN                                 | `…ePass`   | YES | no |
 | 16 | `Designer-Wallcoverings/DW-Programming/generate-justindavid-rooms.py:30` | same DSN                               | `…ePass`   | YES | no |
@@ -41,7 +41,7 @@ These are real, currently-active provider credentials baked into tracked source
 | 22 | `Designer-Wallcoverings/DW-Programming/room-setting-app/batch-room-gen-v2.py:35` | same DSN                       | `…ePass`   | YES | no |
 | 23 | `Designer-Wallcoverings/DW-Programming/room-setting-app/scripts/batch-room-generator.py:37` | same DSN            | `…ePass`   | YES | no |
 | 24 | `ClawCoder/.mcp.json:9`                                                | same DSN (in MCP arg vector)             | `…ePass`   | YES | no |
-| 25 | `wallco-ai/scripts/build-tif.py:56`                                    | same `dw_admin:DW2024SecurePass`         | `…ePass`   | YES | no |
+| 25 | `wallco-ai/scripts/build-tif.py:56`                                    | same `dw_admin:«REDACTED-DB-PW»`         | `…ePass`   | YES | no |
 | 26 | `Designer-Wallcoverings/DW-Programming/ImportNewSkufromURL/fetch-vendor-products.ts:70` | Proxy basic-auth password    | `…whud5bo` | YES | no |
 | 27 | `Designer-Wallcoverings/DW-Programming/ImportNewSkufromURL/extract-all-css-selectors.ts:26` | same                    | `…whud5bo` | YES | no |
 | 28 | `Designer-Wallcoverings/DW-Programming/ImportNewSkufromURL/run-new-scrapers.ts:109` | same                            | `…whud5bo` | YES | no |
@@ -123,9 +123,9 @@ if (!JWT_SECRET) throw new Error('JWT_SECRET env var required (no fallback for p
 |---|-----------|--------|
 | 1 | `AbramsOS/tests/crypto.test.js:62`                                  | test: deliberate "too short" key fixture |
 | 2 | `ventura-claw-leads/tests/{compliance,auth,routes}.test.js`         | test: `'test-secret'` fallback |
-| 3 | `animals/test/lib/{geo,db}.test.js`                                  | test: `'postgresql://fake:fake@localhost…'` |
+| 3 | `animals/test/lib/{geo,db}.test.js`                                  | test: `'postgresql://fake@localhost…'` |
 | 4 | `directory-core/test/{auth,db,db-lazy,auth-factory,compliance-ssrf,_ident,compliance}.test.ts` | test: same fake DSN |
-| 5 | `ventura-claw/lib/mcp/connector-specs.json:713`                     | docs/spec: `postgres://{user}:{pass}@{host}…` template |
+| 5 | `ventura-claw/lib/mcp/connector-specs.json:713`                     | docs/spec: `postgres://{user}@{host}…` template |
 | 6 | `Norma/lib/api-registry.ts:441`                                     | docs string with `xxx@` placeholder |
 | 7 | `ClawCoder/src/lib/marketplace/data.ts:572`                         | docs/install-cmd: `user:pass@host/db` |
 | 8 | `norma-sdcc-pitch/data/features.json:1402`                          | UI placeholder copy |
diff --git a/data/yolo-overnight/MORNING-DIGEST-2026-05-25.md b/data/yolo-overnight/MORNING-DIGEST-2026-05-25.md
index b7448fe..9de8180 100644
--- a/data/yolo-overnight/MORNING-DIGEST-2026-05-25.md
+++ b/data/yolo-overnight/MORNING-DIGEST-2026-05-25.md
@@ -38,7 +38,7 @@
 | **F1** | **`ai_*` columns missing** — 11 SQL errors over 30h. `/api/design/:id/upload-shopify` returns 500. "Coordinates by style" recommender silently returns `[]`. Gemini vision review can't persist. | **PROD-CRITICAL** | `psql dw_unified -c "ALTER TABLE spoon_all_designs ADD COLUMN IF NOT EXISTS ai_title text, ai_pattern text, ai_color_name text, ai_reviewed_at timestamptz, ai_review_raw jsonb;"` — then backfill via `/api/design/:id/ai-designer apply:true` |
 | **F2** | **`designs.json` collapsed 38,302 → 276 entries** during overnight snapshot refresh. Live process still serves 38K from in-mem cache; next `pm2 reload wallco-ai` will collapse visible grid to 276. | **HIGH** | Decision-only. Either (a) revert designs.json from PG widening the `WHERE` clause in `scripts/refresh_designs_snapshot.py`, or (b) accept 276 and reload knowingly. |
 | **F7** | **200 ghost-purge proposals ready** — all dry-runs prepared, all PNGs verified on disk, none previously attempted. 198 low-risk, 2 medium-risk (~$0.08 Gemini). | **HIGH** | See `ghost-purge-proposals-20260525-1047.md` — staged sweep: opacity-snap → tile-edge → ghost-layer. |
-| **F3** | **`.env` misconfig:** `DATABASE_URL=dw_unified` (bare string, not URL). 13 boot warnings. | MEDIUM | Set `MARKETPLACE_DB_URL="postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/dw_unified"` then `./deploy-kamatera.sh` |
+| **F3** | **`.env` misconfig:** `DATABASE_URL=dw_unified` (bare string, not URL). 13 boot warnings. | MEDIUM | Set `MARKETPLACE_DB_URL="postgresql://dw_admin@127.0.0.1:5432/dw_unified"` then `./deploy-kamatera.sh` |
 | **F4** | **`app.set('trust proxy', 1)` missing** → express-rate-limit keys on nginx hop, not real client IP. Defeats rate limiting. | MEDIUM | Add the line near `const app = express()` in `server.js` + deploy. |
 | **F5** | **Port-drift in cron / dashboards** — `9877` was wallco-ai but is now `paint-visualizer-agent` on Kamatera. Wallco-ai on Kamatera is `0.0.0.0:9905`. (Locally 9877 still = wallco-ai.) | MEDIUM | `grep -rn 9877 /root/DW-Agents/agent-cronjob /root/.pm2 nginx/conf.d` → repoint to 9905. |
 | **F6** | **No git repo at `/root/public-projects/wallco-ai` on Kamatera** — rsync-deployed, not git-tracked. Overnight artifacts evaporate on next deploy. | LOW | Either `git init` on prod or sync `data/yolo-overnight/` back to Mac2 origin. |
diff --git a/data/yolo-overnight/SUMMARY-20260525.md b/data/yolo-overnight/SUMMARY-20260525.md
index 261624f..7cd070c 100644
--- a/data/yolo-overnight/SUMMARY-20260525.md
+++ b/data/yolo-overnight/SUMMARY-20260525.md
@@ -28,7 +28,7 @@ Decisions or fixes the loop **deliberately did not** make. Listed roughly by bla
 |---|---|---|---|
 | **F1** | **`column "ai_title" does not exist`** — 11 SQL errors over the 30h window. `POST /api/design/:id/upload-shopify` returns HTTP 500; the "coordinates by style" recommender silently returns `[]`; Gemini vision review never persists. Writer + 2 readers all assume a migration that was never applied. | Schema change. Drafted but not run. | Apply `ALTER TABLE spoon_all_designs ADD COLUMN IF NOT EXISTS ai_title text, ai_pattern text, ai_color_name text, ai_reviewed_at timestamptz, ai_review_raw jsonb`. Then backfill via `/api/design/:id/ai-designer apply:true`. SQL block in `log-errors-20260525-1058.md` §"Bucket 1". |
 | **F2** | **`designs.json` collapsed to 276 entries** (-38,026). Old 38K was built from a richer historical source no longer reproducible from PG alone. Calling `/admin/reload-designs` or `pm2 reload wallco-ai` **will collapse the live grid to 276**. | Live process still serves 38K from in-memory cache. Reloading now would be visibly destructive in the UI. | Decide: (a) revert `data/designs.json` from the pre-refresh state in `.bak` (not captured — should we?), (b) accept the 276 number and reload knowingly, or (c) widen `refresh_designs_snapshot.py`'s WHERE clause beyond the 3 generators it currently includes. |
-| **F3** | **`.env` misconfig: `DATABASE_URL=dw_unified`** — 13 boot warnings. The marketplace DB layer rejects the bare string and falls through to `PGHOST/PGUSER/PGDATABASE`. Connection works; warning is noise; the SASL "password must be a string" error in May 24 logs traces back to this. | One-line `.env` change + redeploy. | Set `MARKETPLACE_DB_URL="postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/dw_unified"` or remove `DATABASE_URL=dw_unified`. Redeploy via `./deploy-kamatera.sh`. |
+| **F3** | **`.env` misconfig: `DATABASE_URL=dw_unified`** — 13 boot warnings. The marketplace DB layer rejects the bare string and falls through to `PGHOST/PGUSER/PGDATABASE`. Connection works; warning is noise; the SASL "password must be a string" error in May 24 logs traces back to this. | One-line `.env` change + redeploy. | Set `MARKETPLACE_DB_URL="postgresql://dw_admin@127.0.0.1:5432/dw_unified"` or remove `DATABASE_URL=dw_unified`. Redeploy via `./deploy-kamatera.sh`. |
 | **F4** | **`app.set('trust proxy', 1)` missing** — `ERR_ERL_UNEXPECTED_X_FORWARDED_FOR` from express-rate-limit (1 trace 2026-05-24). Without it, rate-limit buckets key on the nginx hop instead of the real client IP — defeats limiting. | One-line code change. | Add `app.set('trust proxy', 1)` near the `const app = express()` setup in `server.js`. |
 | **F5** | **Port-drift in cron / dashboards** — Task brief pointed to `127.0.0.1:9877` for wallco-ai routes; that port is now `paint-visualizer-agent` (per commit `4fcbef909`). wallco-ai is on `0.0.0.0:9905`. | Update any monitor / cron / link still pointing at 9877. | Grep for `9877` in `/root/DW-Agents/agent-cronjob/`, `/root/.pm2/`, dashboards. Repoint to 9905. |
 | **F6** | **No git repo at `/root/public-projects/wallco-ai`** — confirmed via `git rev-parse`. Prod box is rsync-deployed from Mac2 via `deploy-kamatera.sh`, not a git working copy. The task's "auto-commit any successful change" step **cannot run on this box**. | Decide whether overnight artifacts (`data/yolo-overnight/*.md`) should be tracked at all. If yes, the Mac2 origin needs to mirror these or `git init` on prod. | Either treat these as ephemeral reports (current behavior) or formalize a sync to the Mac2 origin. |
diff --git a/data/yolo-overnight/frame-overlay-20260525-2350.md b/data/yolo-overnight/frame-overlay-20260525-2350.md
index 7b9abf0..1788fe7 100644
--- a/data/yolo-overnight/frame-overlay-20260525-2350.md
+++ b/data/yolo-overnight/frame-overlay-20260525-2350.md
@@ -50,7 +50,7 @@ Two extra PG-only rows (135 dolce-gabbana, 136 designer-wallcoverings) live in `
 
 ## Bugs discovered in `scripts/fix-frame-overlay.js`
 
-1. **`psql` call has no auth** (line ~67): `spawnSync('psql', ['-d', 'dw_unified', ...])`. On this Linux box, `dw_admin` needs `PGPASSWORD=DW2024SecurePass psql -h 127.0.0.1 -U dw_admin`. Today it silently returns `null` and the fixer reports "local_path missing".
+1. **`psql` call has no auth** (line ~67): `spawnSync('psql', ['-d', 'dw_unified', ...])`. On this Linux box, `dw_admin` needs `PGPASSWORD=«REDACTED-DB-PW» psql -h 127.0.0.1 -U dw_admin`. Today it silently returns `null` and the fixer reports "local_path missing".
 2. **PG paths are Mac-prefixed** (`/Users/stevestudio2/Projects/wallco-ai/data/generated/...`). Even when auth is fixed, `fs.existsSync()` will fail. Needs a translator: `s|^/Users/stevestudio2/Projects/wallco-ai/|/root/public-projects/wallco-ai/|`.
 3. **Single-source resolver**: fix-frame-overlay only consults PG. `scan-frame-overlay` also resolves via `designs.json` → `data/generated/`. Fix script should mirror that fallback so `source=json` rows are reachable.
 
diff --git a/data/yolo-overnight/log-errors-20260525-1058.md b/data/yolo-overnight/log-errors-20260525-1058.md
index 674298e..3b7dea7 100644
--- a/data/yolo-overnight/log-errors-20260525-1058.md
+++ b/data/yolo-overnight/log-errors-20260525-1058.md
@@ -84,7 +84,7 @@ this window).
 **Fix**
 
 In `/root/public-projects/wallco-ai/.env`, either:
-- (preferred) set `MARKETPLACE_DB_URL="postgresql://dw_admin:DW2024SecurePass@127.0.0.1:5432/dw_unified"`, OR
+- (preferred) set `MARKETPLACE_DB_URL="postgresql://dw_admin@127.0.0.1:5432/dw_unified"`, OR
 - delete the `DATABASE_URL=dw_unified` line entirely so the PG* fallbacks aren't a "fallthrough"
   but the documented path. Then redeploy via `./deploy-kamatera.sh`.
← 4e68e65 fix(scripts): DB password from DATABASE_URL (.env), not empt · back to Wallco Ai · settlement vision (2-agent review): keep_alive=2m frees ~8GB f6b54ad →