Skip to content

Comments

fix: move hardcoded admin credentials to env vars and fix console.log syntax error#12

Open
bennytimz wants to merge 3 commits intocirclefin:masterfrom
bennytimz:bennytimz-patch-1
Open

fix: move hardcoded admin credentials to env vars and fix console.log syntax error#12
bennytimz wants to merge 3 commits intocirclefin:masterfrom
bennytimz:bennytimz-patch-1

Conversation

@bennytimz
Copy link

This PR fixes two related issues in lib/supabase/initialize-admin-user.ts:

  1. Hardcoded admin credentials
    The admin password (123456) was hardcoded directly in source code. Anyone with
    read access to the repository knows the default admin password. If a developer
    deploys this app without changing the password, the admin account is immediately
    compromised.
    Fix: The password is now read from a new ADMIN_PASSWORD environment variable.
    The app logs a clear error and skips admin creation if the variable is not set,
    rather than silently creating an account with a publicly known password.
    The email already had an ADMIN_EMAIL env var in .env.example but the code
    wasn't using it — that is also fixed here.
  2. Syntax error in console.log
    // Before (crashes at runtime — missing opening parenthesis)
    console.logAdmin user with email ${adminEmail} created successfully.);

// After (correct)
console.log(Admin user with email ${adminEmail} created successfully.);

This would cause an uncaught SyntaxError the first time the admin user is
successfully created, crashing the initialization function.

Files changed

  • lib/supabase/initialize-admin-user.ts — read credentials from env vars, fix syntax error
  • .env.example — add ADMIN_PASSWORD variable
  • README.md — update admin account documentation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant