security: add DO_CLIENT_SECRET env var override

[la14-1]

Why: Allows users/organizations to supply their own DigitalOcean OAuth client secret via DO_CLIENT_SECRET env var, eliminating the need to modify source code for secret rotation or custom deployments.

Changes

• packages/cli/src/digitalocean/digitalocean.ts: Change DO_CLIENT_SECRET to read from process.env["DO_CLIENT_SECRET"] with fallback to bundled value
• Updated comment to document the env var override
• Bumped CLI version to 0.16.19

Test plan

• Biome check passes
• bun test passes (1381 tests, 0 failures)
• Setting DO_CLIENT_SECRET env var overrides the bundled secret

Fixes#2537

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9dcf40d

Findings

None. The changes are secure and follow best practices.

Analysis

The PR adds support for overriding DO_CLIENT_SECRET via environment variable while maintaining the bundled default. This enables organizations to use custom DigitalOcean OAuth applications.

Security considerations:

• ✅ Environment variable access is safe (no injection risk)
• ✅ Fallback maintains backward compatibility
• ✅ Original OAuth secret pattern is already acceptable for public clients
• ✅ Secret is only used in secure HTTPS POST requests (token exchange, refresh)
• ✅ No logging or exposure of secret values
• ✅ Documentation accurately describes the feature and use case

Code quality:

• ✅ Proper bracket notation for env var access
• ✅ Version bump follows semantic versioning (patch)
• ✅ Clear inline documentation added

Tests

• bash -n: N/A (no shell scripts modified)
• bun test: PASS (verified with do-payment-warning.test.ts)
• curl|bash: N/A (TypeScript only)
• macOS compat: N/A (TypeScript only)

Recommendation

Safe to merge. No security concerns.

---

-- security/pr-reviewer

[la14-1]

Why: Allows users/organizations to supply their own DigitalOcean OAuth client secret via DO_CLIENT_SECRET env var, eliminating the need to modify source code for secret rotation or custom deployments.

Changes

• packages/cli/src/digitalocean/digitalocean.ts: Change DO_CLIENT_SECRET to read from process.env["DO_CLIENT_SECRET"] with fallback to bundled value
• Updated comment to document the env var override
• Bumped CLI version to 0.16.19

Test plan

• Biome check passes
• bun test passes (1381 tests, 0 failures)
• Setting DO_CLIENT_SECRET env var overrides the bundled secret

Fixes#2537

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9dcf40d

Findings

None. The changes are secure and follow best practices.

Analysis

The PR adds support for overriding DO_CLIENT_SECRET via environment variable while maintaining the bundled default. This enables organizations to use custom DigitalOcean OAuth applications.

Security considerations:

• ✅ Environment variable access is safe (no injection risk)
• ✅ Fallback maintains backward compatibility
• ✅ Original OAuth secret pattern is already acceptable for public clients
• ✅ Secret is only used in secure HTTPS POST requests (token exchange, refresh)
• ✅ No logging or exposure of secret values
• ✅ Documentation accurately describes the feature and use case

Code quality:

• ✅ Proper bracket notation for env var access
• ✅ Version bump follows semantic versioning (patch)
• ✅ Clear inline documentation added

Tests

• bash -n: N/A (no shell scripts modified)
• bun test: PASS (verified with do-payment-warning.test.ts)
• curl|bash: N/A (TypeScript only)
• macOS compat: N/A (TypeScript only)

Recommendation

Safe to merge. No security concerns.

---

-- security/pr-reviewer

[la14-1]

Why: Allows users/organizations to supply their own DigitalOcean OAuth client secret via DO_CLIENT_SECRET env var, eliminating the need to modify source code for secret rotation or custom deployments.

Changes

• packages/cli/src/digitalocean/digitalocean.ts: Change DO_CLIENT_SECRET to read from process.env["DO_CLIENT_SECRET"] with fallback to bundled value
• Updated comment to document the env var override
• Bumped CLI version to 0.16.19

Test plan

• Biome check passes
• bun test passes (1381 tests, 0 failures)
• Setting DO_CLIENT_SECRET env var overrides the bundled secret

Fixes#2537

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9dcf40d

Findings

None. The changes are secure and follow best practices.

Analysis

The PR adds support for overriding DO_CLIENT_SECRET via environment variable while maintaining the bundled default. This enables organizations to use custom DigitalOcean OAuth applications.

Security considerations:

• ✅ Environment variable access is safe (no injection risk)
• ✅ Fallback maintains backward compatibility
• ✅ Original OAuth secret pattern is already acceptable for public clients
• ✅ Secret is only used in secure HTTPS POST requests (token exchange, refresh)
• ✅ No logging or exposure of secret values
• ✅ Documentation accurately describes the feature and use case

Code quality:

• ✅ Proper bracket notation for env var access
• ✅ Version bump follows semantic versioning (patch)
• ✅ Clear inline documentation added

Tests

• bash -n: N/A (no shell scripts modified)
• bun test: PASS (verified with do-payment-warning.test.ts)
• curl|bash: N/A (TypeScript only)
• macOS compat: N/A (TypeScript only)

Recommendation

Safe to merge. No security concerns.

---

-- security/pr-reviewer

[la14-1]

Why: Allows users/organizations to supply their own DigitalOcean OAuth client secret via DO_CLIENT_SECRET env var, eliminating the need to modify source code for secret rotation or custom deployments.

Changes

• packages/cli/src/digitalocean/digitalocean.ts: Change DO_CLIENT_SECRET to read from process.env["DO_CLIENT_SECRET"] with fallback to bundled value
• Updated comment to document the env var override
• Bumped CLI version to 0.16.19

Test plan

• Biome check passes
• bun test passes (1381 tests, 0 failures)
• Setting DO_CLIENT_SECRET env var overrides the bundled secret

Fixes#2537

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9dcf40d

Findings

None. The changes are secure and follow best practices.

Analysis

The PR adds support for overriding DO_CLIENT_SECRET via environment variable while maintaining the bundled default. This enables organizations to use custom DigitalOcean OAuth applications.

Security considerations:

• ✅ Environment variable access is safe (no injection risk)
• ✅ Fallback maintains backward compatibility
• ✅ Original OAuth secret pattern is already acceptable for public clients
• ✅ Secret is only used in secure HTTPS POST requests (token exchange, refresh)
• ✅ No logging or exposure of secret values
• ✅ Documentation accurately describes the feature and use case

Code quality:

• ✅ Proper bracket notation for env var access
• ✅ Version bump follows semantic versioning (patch)
• ✅ Clear inline documentation added

Tests

• bash -n: N/A (no shell scripts modified)
• bun test: PASS (verified with do-payment-warning.test.ts)
• curl|bash: N/A (TypeScript only)
• macOS compat: N/A (TypeScript only)

Recommendation

Safe to merge. No security concerns.

---

-- security/pr-reviewer

[la14-1]

Why: Allows users/organizations to supply their own DigitalOcean OAuth client secret via DO_CLIENT_SECRET env var, eliminating the need to modify source code for secret rotation or custom deployments.

Changes

• packages/cli/src/digitalocean/digitalocean.ts: Change DO_CLIENT_SECRET to read from process.env["DO_CLIENT_SECRET"] with fallback to bundled value
• Updated comment to document the env var override
• Bumped CLI version to 0.16.19

Test plan

• Biome check passes
• bun test passes (1381 tests, 0 failures)
• Setting DO_CLIENT_SECRET env var overrides the bundled secret

Fixes#2537

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9dcf40d

Findings

None. The changes are secure and follow best practices.

Analysis

The PR adds support for overriding DO_CLIENT_SECRET via environment variable while maintaining the bundled default. This enables organizations to use custom DigitalOcean OAuth applications.

Security considerations:

• ✅ Environment variable access is safe (no injection risk)
• ✅ Fallback maintains backward compatibility
• ✅ Original OAuth secret pattern is already acceptable for public clients
• ✅ Secret is only used in secure HTTPS POST requests (token exchange, refresh)
• ✅ No logging or exposure of secret values
• ✅ Documentation accurately describes the feature and use case

Code quality:

• ✅ Proper bracket notation for env var access
• ✅ Version bump follows semantic versioning (patch)
• ✅ Clear inline documentation added

Tests

• bash -n: N/A (no shell scripts modified)
• bun test: PASS (verified with do-payment-warning.test.ts)
• curl|bash: N/A (TypeScript only)
• macOS compat: N/A (TypeScript only)

Recommendation

Safe to merge. No security concerns.

---

-- security/pr-reviewer

[la14-1]

Why: Allows users/organizations to supply their own DigitalOcean OAuth client secret via DO_CLIENT_SECRET env var, eliminating the need to modify source code for secret rotation or custom deployments.

Changes

• packages/cli/src/digitalocean/digitalocean.ts: Change DO_CLIENT_SECRET to read from process.env["DO_CLIENT_SECRET"] with fallback to bundled value
• Updated comment to document the env var override
• Bumped CLI version to 0.16.19

Test plan

• Biome check passes
• bun test passes (1381 tests, 0 failures)
• Setting DO_CLIENT_SECRET env var overrides the bundled secret

Fixes#2537

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9dcf40d

Findings

None. The changes are secure and follow best practices.

Analysis

The PR adds support for overriding DO_CLIENT_SECRET via environment variable while maintaining the bundled default. This enables organizations to use custom DigitalOcean OAuth applications.

Security considerations:

• ✅ Environment variable access is safe (no injection risk)
• ✅ Fallback maintains backward compatibility
• ✅ Original OAuth secret pattern is already acceptable for public clients
• ✅ Secret is only used in secure HTTPS POST requests (token exchange, refresh)
• ✅ No logging or exposure of secret values
• ✅ Documentation accurately describes the feature and use case

Code quality:

• ✅ Proper bracket notation for env var access
• ✅ Version bump follows semantic versioning (patch)
• ✅ Clear inline documentation added

Tests

• bash -n: N/A (no shell scripts modified)
• bun test: PASS (verified with do-payment-warning.test.ts)
• curl|bash: N/A (TypeScript only)
• macOS compat: N/A (TypeScript only)

Recommendation

Safe to merge. No security concerns.

---

-- security/pr-reviewer

[la14-1]

Why: Allows users/organizations to supply their own DigitalOcean OAuth client secret via DO_CLIENT_SECRET env var, eliminating the need to modify source code for secret rotation or custom deployments.

Changes

• packages/cli/src/digitalocean/digitalocean.ts: Change DO_CLIENT_SECRET to read from process.env["DO_CLIENT_SECRET"] with fallback to bundled value
• Updated comment to document the env var override
• Bumped CLI version to 0.16.19

Test plan

• Biome check passes
• bun test passes (1381 tests, 0 failures)
• Setting DO_CLIENT_SECRET env var overrides the bundled secret

Fixes#2537

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9dcf40d

Findings

None. The changes are secure and follow best practices.

Analysis

The PR adds support for overriding DO_CLIENT_SECRET via environment variable while maintaining the bundled default. This enables organizations to use custom DigitalOcean OAuth applications.

Security considerations:

• ✅ Environment variable access is safe (no injection risk)
• ✅ Fallback maintains backward compatibility
• ✅ Original OAuth secret pattern is already acceptable for public clients
• ✅ Secret is only used in secure HTTPS POST requests (token exchange, refresh)
• ✅ No logging or exposure of secret values
• ✅ Documentation accurately describes the feature and use case

Code quality:

• ✅ Proper bracket notation for env var access
• ✅ Version bump follows semantic versioning (patch)
• ✅ Clear inline documentation added

Tests

• bash -n: N/A (no shell scripts modified)
• bun test: PASS (verified with do-payment-warning.test.ts)
• curl|bash: N/A (TypeScript only)
• macOS compat: N/A (TypeScript only)

Recommendation

Safe to merge. No security concerns.

---

-- security/pr-reviewer

[la14-1]

Why: Allows users/organizations to supply their own DigitalOcean OAuth client secret via DO_CLIENT_SECRET env var, eliminating the need to modify source code for secret rotation or custom deployments.

Changes

• packages/cli/src/digitalocean/digitalocean.ts: Change DO_CLIENT_SECRET to read from process.env["DO_CLIENT_SECRET"] with fallback to bundled value
• Updated comment to document the env var override
• Bumped CLI version to 0.16.19

Test plan

• Biome check passes
• bun test passes (1381 tests, 0 failures)
• Setting DO_CLIENT_SECRET env var overrides the bundled secret

Fixes#2537

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9dcf40d

Findings

None. The changes are secure and follow best practices.

Analysis

The PR adds support for overriding DO_CLIENT_SECRET via environment variable while maintaining the bundled default. This enables organizations to use custom DigitalOcean OAuth applications.

Security considerations:

• ✅ Environment variable access is safe (no injection risk)
• ✅ Fallback maintains backward compatibility
• ✅ Original OAuth secret pattern is already acceptable for public clients
• ✅ Secret is only used in secure HTTPS POST requests (token exchange, refresh)
• ✅ No logging or exposure of secret values
• ✅ Documentation accurately describes the feature and use case

Code quality:

• ✅ Proper bracket notation for env var access
• ✅ Version bump follows semantic versioning (patch)
• ✅ Clear inline documentation added

Tests

• bash -n: N/A (no shell scripts modified)
• bun test: PASS (verified with do-payment-warning.test.ts)
• curl|bash: N/A (TypeScript only)
• macOS compat: N/A (TypeScript only)

Recommendation

Safe to merge. No security concerns.

---

-- security/pr-reviewer