What's pending across every project
9 open · sorted by priority then due-date
blocker
urgent
Revoke exposed GitHub PAT shared in chat session
RoadIntelix
· roadintelix
· by Prajith
from the conversationprajith: [shared GitHub PAT in chat to clone private repo]\nclaude: Please revoke this token immediately — GitHub Settings → Developer settings → Fine-grained tokens → delete it.
131d ago
06-18 04:24
06-18 04:24
todo
urgent
Rotate Razorpay webhook secret — 'hopewell' is guessable
The RAZORPAY_SECRET_WEBHOOK value in /opt/ocpp/.env on the production VM is literally 'hopewell' — a common English word, effectively no protection. HMAC verification against a guessable secret means anyone who learns the plaintext can forge webhook calls and credit any wallet.
Fix:
1. Razorpay Dashboard → Settings → Webhooks → regenerate a long random secret (32+ char base64).
2. Update /opt/ocpp/.env on the VM (SMTP_PASSWORD-style edit).
3. sudo systemctl restart ocpp.service.
4. Send a test webhook from Razorpay dashboard and confirm it verifies.
This is the single most impactful hardening we can do.
/opt/ocpp/.envinternal/handlers/wallet_handler.go:239-254↗ https://dashboard.razorpay.com/app/webhooks
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
from the conversationclaude: RAZORPAY_SECRET_WEBHOOK=hopewell in .env is weak - anyone who guesses the plaintext can forge webhooks (i.e., forge topups). Regenerate a long random secret in the Razorpay dashboard and update .env, then restart the service. This is the single most impactful hardening you can do.
saravanan: put them in my project tracker - scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
urgent
Close Cloud SQL to the internet: remove 0.0.0.0 authorized network and require SSL
Instance crypto-track-321e8b45 has a public IP (34.57.238.28), requireSsl=false (ALLOW_UNENCRYPTED_AND_ENCRYPTED), and an authorized network "for EV Connection" = 0.0.0.0 — effectively open to the internet with only the postgres password protecting it. Instance is shared with AdaptiveSAT, Vajra, CitrineOS, tracker. Coordinate with Vajra before removing the EV entry; prefer Cloud SQL connector/Auth Proxy for all clients.
gcloud sql instances describe crypto-track-321e8b45
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The database is effectively open to the internet: public IP, SSL optional, authorized network 0.0.0.0.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Rotate the postgres superuser password and remove it from code
Password is committed/hardcoded in crypto538-core-service/config/production.yaml + staging.yaml, ml-core-service/main.py, and every CoinTrends_Python script (with the public DB IP). Rotation affects every service on the shared instance. Move to Secret Manager (db_password secret already exists) and read at runtime.
crypto538-core-service/config/production.yamlcrypto538-core-service/config/staging.yamlml-core-service/main.py::get_db_connectionCoinTrends_Python/*.py
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The postgres superuser password is committed in several places and every service connects as that superuser.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Revoke the committed prod service-account keys and switch to keyless auth
prj-crypto538-prod-260529-*.json key files are in crypto538-core-service, ml-core-service and CoinTrends_Python. Disable/delete those keys in IAM, remove from repos (history too, or treat as burned), rely on Cloud Run service identity / Workload Identity Federation.
crypto538-core-service/prj-crypto538-prod-260529-9964278419d2.jsonml-core-service/prj-crypto538-prod-260529-c7d42674bd4d.json
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: Production service-account key JSONs are committed in two repos and CoinTrends_Python.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Rotate hardcoded API keys (CoinMarketCap, TAAPI, OpenAI) and web-service .env secrets; move to Secret Manager
Keys hardcoded in core main.go constants (per CODE_REVIEW.md #1). web-service .env / .env.staging / .env.production committed with TOKEN_SECRET_KEY, ENCRYPTION_KEY, Stripe keys etc. Rotate, then inject via Secret Manager env refs on Cloud Run.
crypto538-core-service/main.go:157-165crypto538-core-service/main.go:331crypto538-web-service/.envcrypto538-core-service/CODE_REVIEW.md
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: CoinMarketCap, TAAPI and OpenAI keys are hardcoded in main.go; web-service .env files hold JWT and Stripe secrets.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Lock down core service: require auth, especially /db/execStoredProc, /deletefile, /uploadfile, /purgeStageData, /insertdb
crypto538-core-service is deployed --allow-unauthenticated. Options: make it private (IAM invoker = web-service SA + Scheduler SA) and have the webapp go through web-service only; or add an API-key/OIDC check on admin/write routes. Ties to the item about the webapp calling core directly.
crypto538-core-service/main.go:486-532crypto538-core-service/cloudbuild.yaml
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The core service needs no authentication, including /db/execStoredProc, /insertdb, /uploadfile, /deletefile.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Live predictions are worse than "price stays the same" and ~50% on direction — fix before selling predictions
DB query 2026-10-19, last 30 days, slice 24 (2h ahead), all coins except TON: model error is ~2x the naive no-change baseline (BTC 0.555% vs 0.333%, ETH 0.868% vs 0.436%, DOGE 2.80% vs 0.71%), direction hit rate 49-51% (coin flip), and strong up-bias (DOGE predicts up 100% of the time, SOL/AVAX 89%). Also 2,489 predictions stored as NaN in 30 days. dbo.predictionvsactual is empty, so accuracy was never tracked. Retraining (#90) alone may not fix this — evaluate against the naive baseline in #115 and consider the model/target design.
#90#115dbo.<pair>_predictiondatadbo.predictionvsactual
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: I want you to access the database and query how the data looks like
claude: Compared 30 days of 2h-ahead predictions with actual prices: model error ~2x a no-change baseline, direction ~50%.
7d ago
10-19 14:07
10-19 14:07
blocker
urgent
Lock down core-service /db/execStoredProc: public, no auth, runs any schema.function as postgres
The crypto538-core-service-production endpoint is reachable by anyone: Cloud Run ingress is "all" and allUsers has run.invoker. The handler (stored_proc.go handleExecStoredProc) has no authentication and no allowlist. It accepts any "schema.function" name plus arguments and runs it on the shared Cloud SQL instance as postgres, which is also used by AdaptiveSAT, Vajra and CitrineOS. That includes the dynamic-DDL routines (table_creation_package, tb_*_generator, sp_initialdata_generator). Not exploited or tested. Suggested fix: allowlist the procs actually used plus a shared-secret or IAM check, or remove the route if unused. Validate callers first, per the cleanup rule.
crypto538-core-service/stored_proc.go:135crypto538-core-service/main.go:494
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
6d ago
10-20 12:44
10-20 12:44