25f65326d4
The backend master SIGNAL_API_KEY had leaked via two paths: - baked into the public Vite bundle via VITE_SIGNAL_API_KEY (Vercel) - hardcoded as a fallback in scripts/signal_e2e_test.py The key has been rotated on Railway (old value now returns 401) and the VITE_SIGNAL_API_KEY var removed from Vercel. This commit removes the two code paths so the master key can never be re-baked or re-committed: - signal-ui/src/lib/api.js: drop the X-API-Key fallback entirely; the frontend now authenticates only with the signed-in user's Clerk token - scripts/signal_e2e_test.py: read SIGNAL_API_KEY from env only; exit if unset Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| components | ||
| lib | ||
| App.jsx | ||
| index.css | ||
| main.jsx | ||
| Privacy.jsx | ||
| ThemeContext.js | ||
| ThemeProvider.jsx | ||
| useTheme.js | ||