chore: redact bootstrap password literal from tracked spec per §0.2

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Simon-Pierre Boucher committed yesterday (Aug 9, 2026) parent d5efae5

Showing 1 changed file with +3 and −3

modified CLAUDE.md +3 −3

		`@@ -16,7 +16,7 @@`
16	16	\| Deployment host \| Node m3u96b \|
17	17	\| Runtime \| Node.js ≥ 20, ESM only \|
18	18	\| Access model \| Private by default. The entire drive is behind a password login. The ONLY public surfaces are explicitly created share links. \|
19		−\| Initial password \| `sn18brady` — seeded at first boot, stored argon2-hashed, never in code, never in the repo, never logged. Changeable from Settings. \|
	19	+\| Initial password \| (redacted per §0.2 — supplied via `SPBDRIVE_BOOTSTRAP_PASSWORD` at first boot) — seeded at first boot, stored argon2-hashed, never in code, never in the repo, never logged. Changeable from Settings. \|
20	20
21	21	### 0.1 THE GOLDEN RULE — Mandatory Author Header
22	22
		@@ -49,7 +49,7 @@ Provide `scripts/inject-headers.mjs` and `scripts/check-headers.mjs`; `npm run c
49	49
50	50	### 0.2 Password / secret handling rules (absolute)
51	51
52		−- The literal string `sn18brady` must appear nowhere in the codebase, config files, tests, fixtures, or logs. It is provided once via the `SPBDRIVE_BOOTSTRAP_PASSWORD` env var (or interactive prompt) on first boot, hashed with argon2id, stored in `data/auth.json`, and the env var is then ignored forever.
	52	+- The literal bootstrap password string must appear nowhere in the codebase, config files, tests, fixtures, or logs. It is provided once via the `SPBDRIVE_BOOTSTRAP_PASSWORD` env var (or interactive prompt) on first boot, hashed with argon2id, stored in `data/auth.json`, and the env var is then ignored forever.
53	53	- Password change flow in Settings (requires current password). Also a break-glass CLI on the server: `node scripts/reset-password.mjs` (interactive, local only).
54	54	- Session secret, share-link signing key: generated randomly at first boot into `data/keys.json` (chmod 600).
55	55
		@@ -319,7 +319,7 @@ Document: register `drive.spboucher.ai` in the ngrok dashboard, add the CNAME at
319	319
320	320	## 12. Security Checklist (verify each before "done")
321	321
322		−- [ ] `sn18brady` appears nowhere in the repo; grep in CI (`check:secrets` script) proves it.
	322	+- [ ] The bootstrap password literal appears nowhere in the repo; grep in CI (`check:secrets` script) proves it.
323	323	- [ ] argon2id everywhere (login, share passwords); constant-time token compares; lockout works (test it).
324	324	- [ ] All cookies `httpOnly` + `Secure` + `SameSite=Lax`; CSRF token on state-changing form posts.
325	325	- [ ] Share tokens ≥ 58 bits entropy; revocation immediate; expired links leak nothing (no filename in error page title).
326	326