What's pending across every project
2 open · sorted by priority then due-date
Filtered by tag prod clear
todo
urgent
Rotate Razorpay webhook secret — 'hopewell' is guessable
The RAZORPAY_SECRET_WEBHOOK value in /opt/ocpp/.env on the production VM is literally 'hopewell' — a common English word, effectively no protection. HMAC verification against a guessable secret means anyone who learns the plaintext can forge webhook calls and credit any wallet.
Fix:
1. Razorpay Dashboard → Settings → Webhooks → regenerate a long random secret (32+ char base64).
2. Update /opt/ocpp/.env on the VM (SMTP_PASSWORD-style edit).
3. sudo systemctl restart ocpp.service.
4. Send a test webhook from Razorpay dashboard and confirm it verifies.
This is the single most impactful hardening we can do.
/opt/ocpp/.envinternal/handlers/wallet_handler.go:239-254↗ https://dashboard.razorpay.com/app/webhooks
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
from the conversationclaude: RAZORPAY_SECRET_WEBHOOK=hopewell in .env is weak - anyone who guesses the plaintext can forge webhooks (i.e., forge topups). Regenerate a long random secret in the Razorpay dashboard and update .env, then restart the service. This is the single most impactful hardening you can do.
saravanan: put them in my project tracker - scrumclaw.ai
42d ago
07-31 02:51
07-31 02:51
todo
high
Change seeded CMS admin password — admin123 is in the migration file and the CMS is now public
VajraCMS went live at https://cms.vajravolt.com on 2026-09-07. The seed account created by VajraBackendGo/migrations/0033_cms_user.up.sql is admin@vajravolt.in / admin123 — the plaintext password is written in the migration, so anyone with repo access has working credentials to the production CMS.
Saravanan chose to defer this on the day. Not blocking anything, but it should not sit for long.
If there is no change-password UI yet, on the VM:
UPDATE "CMSUser" SET password_hash = crypt('NEW', gen_salt('bf',10)) WHERE email='admin@vajravolt.in';
(pgcrypto bcrypt matches what the CMS auth controller compares against)
Verify the old one stops working:
curl -s -o /dev/null -w '%{http_code}\n' -X POST https://cms-api.vajravolt.com/api/v1/auth/login \
-H 'Content-Type: application/json' -d '{"email":"admin@vajravolt.in","password":"admin123"}'
Expect 401.</body>
migrations/0033_cms_user.up.sql↗ https://cms.vajravolt.com
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
from the conversationclaude: admin@vajravolt.in / admin123 is written in plaintext in migration 0033 and the CMS is now on the public internet — anyone with repo access has working credentials.
saravanan: no pwd change now -
claude: Noted — leaving it, tracked as open.
3d ago
09-07 22:20
09-07 22:20