What's pending across every project
3 open · sorted by priority then due-date
Filtered by tag secrets clear
todo
urgent
Rotate the postgres superuser password and remove it from code
Password is committed/hardcoded in crypto538-core-service/config/production.yaml + staging.yaml, ml-core-service/main.py, and every CoinTrends_Python script (with the public DB IP). Rotation affects every service on the shared instance. Move to Secret Manager (db_password secret already exists) and read at runtime.
crypto538-core-service/config/production.yamlcrypto538-core-service/config/staging.yamlml-core-service/main.py::get_db_connectionCoinTrends_Python/*.py
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The postgres superuser password is committed in several places and every service connects as that superuser.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Revoke the committed prod service-account keys and switch to keyless auth
prj-crypto538-prod-260529-*.json key files are in crypto538-core-service, ml-core-service and CoinTrends_Python. Disable/delete those keys in IAM, remove from repos (history too, or treat as burned), rely on Cloud Run service identity / Workload Identity Federation.
crypto538-core-service/prj-crypto538-prod-260529-9964278419d2.jsonml-core-service/prj-crypto538-prod-260529-c7d42674bd4d.json
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: Production service-account key JSONs are committed in two repos and CoinTrends_Python.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Rotate hardcoded API keys (CoinMarketCap, TAAPI, OpenAI) and web-service .env secrets; move to Secret Manager
Keys hardcoded in core main.go constants (per CODE_REVIEW.md #1). web-service .env / .env.staging / .env.production committed with TOKEN_SECRET_KEY, ENCRYPTION_KEY, Stripe keys etc. Rotate, then inject via Secret Manager env refs on Cloud Run.
crypto538-core-service/main.go:157-165crypto538-core-service/main.go:331crypto538-web-service/.envcrypto538-core-service/CODE_REVIEW.md
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: CoinMarketCap, TAAPI and OpenAI keys are hardcoded in main.go; web-service .env files hold JWT and Stripe secrets.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08