2 commits

Author	SHA1	Message	Date
Kisa	25f65326d4	security: rotate leaked Signal API key, remove it from frontend + source ... The backend master SIGNAL_API_KEY had leaked via two paths: - baked into the public Vite bundle via VITE_SIGNAL_API_KEY (Vercel) - hardcoded as a fallback in scripts/signal_e2e_test.py The key has been rotated on Railway (old value now returns 401) and the VITE_SIGNAL_API_KEY var removed from Vercel. This commit removes the two code paths so the master key can never be re-baked or re-committed: - signal-ui/src/lib/api.js: drop the X-API-Key fallback entirely; the frontend now authenticates only with the signed-in user's Clerk token - scripts/signal_e2e_test.py: read SIGNAL_API_KEY from env only; exit if unset Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-21 14:00:54 -04:00
Kisa	42a79c6682	add pitch assets, fix UI and backend bugs, add test utilities ... - add 3 signal pitch assets (workflow flowchart, market opportunity, win-win-win) as HTML + PNG - fix doc_state_machine cascade and supplied sentinel flags - fix CSVImport mapping review, WorklistTable colored bullets and expand row - fix App.jsx auth gate, api.js CORS handling - add signal E2E test script and stress test generator Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-19 12:52:29 -04:00