Remove hardcoded DATABASE_URL fallback from prisma.config.ts - #275

Merged
joryirving merged 1 commit into
mainfrom
fix/remove-hardcoded-db-credentials
May 29, 2026
Merged

Remove hardcoded DATABASE_URL fallback from prisma.config.ts#275
joryirving merged 1 commit into
mainfrom
fix/remove-hardcoded-db-credentials

Conversation

@itsmiso-ai

@itsmiso-aiitsmiso-ai commented May 29, 2026

Copy link
Copy Markdown
Contributor

Removes the hardcoded postgresql://localhost:5432/dispatch fallback from prisma.config.ts and requires DATABASE_URL to be set explicitly in all environments.

This eliminates the supply-chain risk of a hardcoded database connection string in committed source code, as flagged by the weekly tech debt audit.

Fixes#271

Jory Irving
Remove hardcoded DATABASE_URL fallback from prisma.config.ts
b846d55
Require DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded localhost
database connection string in committed source code.
its-saffron[bot]
its-saffronBot approved these changes May 29, 2026
View reviewed changes

@its-saffronits-saffronBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Automated Review

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)

PR Review: Remove hardcoded DATABASE_URL fallback from prisma.config.ts

Recommendation: Approve

This PR correctly addresses issue #271 by eliminating the supply-chain risk of hardcoded database credentials in committed source code.

Change Summary

The diff modifies prisma.config.ts with two targeted changes:

  1. Expands validation scope: Changed if (process.env.NODE_ENV === "production" && !databaseUrl) to if (!databaseUrl) — now requires DATABASE_URL in all environments, not just production
  2. Removes fallback: Eliminated the ?? "postgresql://localhost:5432/dispatch" fallback from the datasource URL

Linked Issue Fit

Issue #271 RequirementPR ImplementationStatus
Remove hardcoded fallback credentials (dispatch:dispatch)Fallback removed entirely✅ Satisfied
Require DATABASE_URL to be set explicitlyCheck now throws in all environments✅ Satisfied
Eliminate supply-chain risk from error reports/screenshotsCredentials no longer in committed source✅ Satisfied

The PR follows the first recommendation from the issue (remove entirely) rather than the alternative placeholder approach.

Standards Compliance

Per AGENTS.md conventions:

  • ✅ No commit of secrets — Never commit .env files, node_modules, .next, or build output. This PR directly advances this goal by removing committed credentials.
  • ✅ Environment Variables — DATABASE_URL is documented as Yes (required) in the conventions. The new check enforces this contract.

Breaking Changes Assessment

Repository impact scan shows DATABASE_URL is properly set in:

  • .github/workflows/ci.yaml:25 — Sets DATABASE_URL for test environment
  • .github/workflows/image.yaml:67,76,77 — Sets DATABASE_URL for Docker image operations
  • Dockerfile:15,23 — ARG/ENV for build-time configuration
  • vitest.setup.ts:6 — Test setup has separate fallback for test database

CI and container builds are unaffected as they provide the variable explicitly. Local dev now requires .env configuration, which is the intended behavior.

Evidence Provider Findings

No evidence providers configured — no findings to report.

Tool Harness Findings

Tool harness planning failed to parse, but this is a single-file security fix with straightforward implementation. No harness execution was required.

Unknowns / Needs Verification

None. The implementation is straightforward, the issue is well-scoped, and the fix is internally consistent with repository conventions.

@joryirving
joryirving merged commit 19b7d5a into mainMay 29, 2026
3 checks passed
@joryirving
joryirving deleted the fix/remove-hardcoded-db-credentials branch May 29, 2026 18:08
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@its-saffronits-saffron[bot]its-saffron[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Remove hardcoded fallback credentials

2 participants

@itsmiso-ai@joryirving
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Remove hardcoded DATABASE_URL fallback from prisma.config.ts - #275
Merged
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
May 29, 2026
Merged
Remove hardcoded DATABASE_URL fallback from prisma.config.ts#275
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
Conversation
@itsmiso-ai
@itsmiso-aiitsmiso-ai
commented
May 29, 2026

Copy link


Copy Markdown

Contributor
Removes the hardcoded postgresql://localhost:5432/dispatch fallback from prisma.config.ts and requires DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded database connection string in committed source code, as flagged by the weekly tech debt audit.
Fixes#271
Jory Irving
Remove hardcoded DATABASE_URL fallback from prisma.config.ts
b846d55
Require DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded localhost
database connection string in committed source code.
its-saffron[bot]
its-saffronBot
approved these changes
May 29, 2026
View reviewed changes
@its-saffronits-saffronBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Automated Review
Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)
PR Review: Remove hardcoded DATABASE_URL fallback from prisma.config.ts
Recommendation: Approve
This PR correctly addresses issue #271 by eliminating the supply-chain risk of hardcoded database credentials in committed source code.
Change Summary
The diff modifies prisma.config.ts with two targeted changes:
  1. Expands validation scope: Changed if (process.env.NODE_ENV === "production" && !databaseUrl) to if (!databaseUrl) — now requires DATABASE_URL in all environments, not just production
  2. Removes fallback: Eliminated the ?? "postgresql://localhost:5432/dispatch" fallback from the datasource URL
Linked Issue Fit
Issue #271 RequirementPR ImplementationStatus
Remove hardcoded fallback credentials (dispatch:dispatch)Fallback removed entirely✅ Satisfied
Require DATABASE_URL to be set explicitlyCheck now throws in all environments✅ Satisfied
Eliminate supply-chain risk from error reports/screenshotsCredentials no longer in committed source✅ Satisfied
The PR follows the first recommendation from the issue (remove entirely) rather than the alternative placeholder approach.
Standards Compliance
Per AGENTS.md conventions:
  • ✅ No commit of secrets — Never commit .env files, node_modules, .next, or build output. This PR directly advances this goal by removing committed credentials.
  • ✅ Environment Variables — DATABASE_URL is documented as Yes (required) in the conventions. The new check enforces this contract.
Breaking Changes Assessment
Repository impact scan shows DATABASE_URL is properly set in:
  • .github/workflows/ci.yaml:25 — Sets DATABASE_URL for test environment
  • .github/workflows/image.yaml:67,76,77 — Sets DATABASE_URL for Docker image operations
  • Dockerfile:15,23 — ARG/ENV for build-time configuration
  • vitest.setup.ts:6 — Test setup has separate fallback for test database
CI and container builds are unaffected as they provide the variable explicitly. Local dev now requires .env configuration, which is the intended behavior.
Evidence Provider Findings
No evidence providers configured — no findings to report.
Tool Harness Findings
Tool harness planning failed to parse, but this is a single-file security fix with straightforward implementation. No harness execution was required.
Unknowns / Needs Verification
None. The implementation is straightforward, the issue is well-scoped, and the fix is internally consistent with repository conventions.
@joryirving
joryirving
merged commit 19b7d5a
into
mainMay 29, 2026

3 checks passed

@joryirving
joryirving
deleted the

fix/remove-hardcoded-db-credentials

branch
May 29, 2026 18:08
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@its-saffronits-saffron[bot]its-saffron[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

Remove hardcoded fallback credentials


2 participants

@itsmiso-ai@joryirving

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Remove hardcoded DATABASE_URL fallback from prisma.config.ts - #275
Merged
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
May 29, 2026
Merged
Remove hardcoded DATABASE_URL fallback from prisma.config.ts#275
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
Conversation
@itsmiso-ai
@itsmiso-aiitsmiso-ai
commented
May 29, 2026

Copy link


Copy Markdown

Contributor
Removes the hardcoded postgresql://localhost:5432/dispatch fallback from prisma.config.ts and requires DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded database connection string in committed source code, as flagged by the weekly tech debt audit.
Fixes#271
Jory Irving
Remove hardcoded DATABASE_URL fallback from prisma.config.ts
b846d55
Require DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded localhost
database connection string in committed source code.
its-saffron[bot]
its-saffronBot
approved these changes
May 29, 2026
View reviewed changes
@its-saffronits-saffronBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Automated Review
Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)
PR Review: Remove hardcoded DATABASE_URL fallback from prisma.config.ts
Recommendation: Approve
This PR correctly addresses issue #271 by eliminating the supply-chain risk of hardcoded database credentials in committed source code.
Change Summary
The diff modifies prisma.config.ts with two targeted changes:
  1. Expands validation scope: Changed if (process.env.NODE_ENV === "production" && !databaseUrl) to if (!databaseUrl) — now requires DATABASE_URL in all environments, not just production
  2. Removes fallback: Eliminated the ?? "postgresql://localhost:5432/dispatch" fallback from the datasource URL
Linked Issue Fit
Issue #271 RequirementPR ImplementationStatus
Remove hardcoded fallback credentials (dispatch:dispatch)Fallback removed entirely✅ Satisfied
Require DATABASE_URL to be set explicitlyCheck now throws in all environments✅ Satisfied
Eliminate supply-chain risk from error reports/screenshotsCredentials no longer in committed source✅ Satisfied
The PR follows the first recommendation from the issue (remove entirely) rather than the alternative placeholder approach.
Standards Compliance
Per AGENTS.md conventions:
  • ✅ No commit of secrets — Never commit .env files, node_modules, .next, or build output. This PR directly advances this goal by removing committed credentials.
  • ✅ Environment Variables — DATABASE_URL is documented as Yes (required) in the conventions. The new check enforces this contract.
Breaking Changes Assessment
Repository impact scan shows DATABASE_URL is properly set in:
  • .github/workflows/ci.yaml:25 — Sets DATABASE_URL for test environment
  • .github/workflows/image.yaml:67,76,77 — Sets DATABASE_URL for Docker image operations
  • Dockerfile:15,23 — ARG/ENV for build-time configuration
  • vitest.setup.ts:6 — Test setup has separate fallback for test database
CI and container builds are unaffected as they provide the variable explicitly. Local dev now requires .env configuration, which is the intended behavior.
Evidence Provider Findings
No evidence providers configured — no findings to report.
Tool Harness Findings
Tool harness planning failed to parse, but this is a single-file security fix with straightforward implementation. No harness execution was required.
Unknowns / Needs Verification
None. The implementation is straightforward, the issue is well-scoped, and the fix is internally consistent with repository conventions.
@joryirving
joryirving
merged commit 19b7d5a
into
mainMay 29, 2026

3 checks passed

@joryirving
joryirving
deleted the

fix/remove-hardcoded-db-credentials

branch
May 29, 2026 18:08
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@its-saffronits-saffron[bot]its-saffron[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

Remove hardcoded fallback credentials


2 participants

@itsmiso-ai@joryirving

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Remove hardcoded DATABASE_URL fallback from prisma.config.ts - #275
Merged
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
May 29, 2026
Merged
Remove hardcoded DATABASE_URL fallback from prisma.config.ts#275
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
Conversation
@itsmiso-ai
@itsmiso-aiitsmiso-ai
commented
May 29, 2026

Copy link


Copy Markdown

Contributor
Removes the hardcoded postgresql://localhost:5432/dispatch fallback from prisma.config.ts and requires DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded database connection string in committed source code, as flagged by the weekly tech debt audit.
Fixes#271
Jory Irving
Remove hardcoded DATABASE_URL fallback from prisma.config.ts
b846d55
Require DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded localhost
database connection string in committed source code.
its-saffron[bot]
its-saffronBot
approved these changes
May 29, 2026
View reviewed changes
@its-saffronits-saffronBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Automated Review
Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)
PR Review: Remove hardcoded DATABASE_URL fallback from prisma.config.ts
Recommendation: Approve
This PR correctly addresses issue #271 by eliminating the supply-chain risk of hardcoded database credentials in committed source code.
Change Summary
The diff modifies prisma.config.ts with two targeted changes:
  1. Expands validation scope: Changed if (process.env.NODE_ENV === "production" && !databaseUrl) to if (!databaseUrl) — now requires DATABASE_URL in all environments, not just production
  2. Removes fallback: Eliminated the ?? "postgresql://localhost:5432/dispatch" fallback from the datasource URL
Linked Issue Fit
Issue #271 RequirementPR ImplementationStatus
Remove hardcoded fallback credentials (dispatch:dispatch)Fallback removed entirely✅ Satisfied
Require DATABASE_URL to be set explicitlyCheck now throws in all environments✅ Satisfied
Eliminate supply-chain risk from error reports/screenshotsCredentials no longer in committed source✅ Satisfied
The PR follows the first recommendation from the issue (remove entirely) rather than the alternative placeholder approach.
Standards Compliance
Per AGENTS.md conventions:
  • ✅ No commit of secrets — Never commit .env files, node_modules, .next, or build output. This PR directly advances this goal by removing committed credentials.
  • ✅ Environment Variables — DATABASE_URL is documented as Yes (required) in the conventions. The new check enforces this contract.
Breaking Changes Assessment
Repository impact scan shows DATABASE_URL is properly set in:
  • .github/workflows/ci.yaml:25 — Sets DATABASE_URL for test environment
  • .github/workflows/image.yaml:67,76,77 — Sets DATABASE_URL for Docker image operations
  • Dockerfile:15,23 — ARG/ENV for build-time configuration
  • vitest.setup.ts:6 — Test setup has separate fallback for test database
CI and container builds are unaffected as they provide the variable explicitly. Local dev now requires .env configuration, which is the intended behavior.
Evidence Provider Findings
No evidence providers configured — no findings to report.
Tool Harness Findings
Tool harness planning failed to parse, but this is a single-file security fix with straightforward implementation. No harness execution was required.
Unknowns / Needs Verification
None. The implementation is straightforward, the issue is well-scoped, and the fix is internally consistent with repository conventions.
@joryirving
joryirving
merged commit 19b7d5a
into
mainMay 29, 2026

3 checks passed

@joryirving
joryirving
deleted the

fix/remove-hardcoded-db-credentials

branch
May 29, 2026 18:08
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@its-saffronits-saffron[bot]its-saffron[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

Remove hardcoded fallback credentials


2 participants

@itsmiso-ai@joryirving

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Remove hardcoded DATABASE_URL fallback from prisma.config.ts - #275
Merged
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
May 29, 2026
Merged
Remove hardcoded DATABASE_URL fallback from prisma.config.ts#275
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
Conversation
@itsmiso-ai
@itsmiso-aiitsmiso-ai
commented
May 29, 2026

Copy link


Copy Markdown

Contributor
Removes the hardcoded postgresql://localhost:5432/dispatch fallback from prisma.config.ts and requires DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded database connection string in committed source code, as flagged by the weekly tech debt audit.
Fixes#271
Jory Irving
Remove hardcoded DATABASE_URL fallback from prisma.config.ts
b846d55
Require DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded localhost
database connection string in committed source code.
its-saffron[bot]
its-saffronBot
approved these changes
May 29, 2026
View reviewed changes
@its-saffronits-saffronBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Automated Review
Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)
PR Review: Remove hardcoded DATABASE_URL fallback from prisma.config.ts
Recommendation: Approve
This PR correctly addresses issue #271 by eliminating the supply-chain risk of hardcoded database credentials in committed source code.
Change Summary
The diff modifies prisma.config.ts with two targeted changes:
  1. Expands validation scope: Changed if (process.env.NODE_ENV === "production" && !databaseUrl) to if (!databaseUrl) — now requires DATABASE_URL in all environments, not just production
  2. Removes fallback: Eliminated the ?? "postgresql://localhost:5432/dispatch" fallback from the datasource URL
Linked Issue Fit
Issue #271 RequirementPR ImplementationStatus
Remove hardcoded fallback credentials (dispatch:dispatch)Fallback removed entirely✅ Satisfied
Require DATABASE_URL to be set explicitlyCheck now throws in all environments✅ Satisfied
Eliminate supply-chain risk from error reports/screenshotsCredentials no longer in committed source✅ Satisfied
The PR follows the first recommendation from the issue (remove entirely) rather than the alternative placeholder approach.
Standards Compliance
Per AGENTS.md conventions:
  • ✅ No commit of secrets — Never commit .env files, node_modules, .next, or build output. This PR directly advances this goal by removing committed credentials.
  • ✅ Environment Variables — DATABASE_URL is documented as Yes (required) in the conventions. The new check enforces this contract.
Breaking Changes Assessment
Repository impact scan shows DATABASE_URL is properly set in:
  • .github/workflows/ci.yaml:25 — Sets DATABASE_URL for test environment
  • .github/workflows/image.yaml:67,76,77 — Sets DATABASE_URL for Docker image operations
  • Dockerfile:15,23 — ARG/ENV for build-time configuration
  • vitest.setup.ts:6 — Test setup has separate fallback for test database
CI and container builds are unaffected as they provide the variable explicitly. Local dev now requires .env configuration, which is the intended behavior.
Evidence Provider Findings
No evidence providers configured — no findings to report.
Tool Harness Findings
Tool harness planning failed to parse, but this is a single-file security fix with straightforward implementation. No harness execution was required.
Unknowns / Needs Verification
None. The implementation is straightforward, the issue is well-scoped, and the fix is internally consistent with repository conventions.
@joryirving
joryirving
merged commit 19b7d5a
into
mainMay 29, 2026

3 checks passed

@joryirving
joryirving
deleted the

fix/remove-hardcoded-db-credentials

branch
May 29, 2026 18:08
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@its-saffronits-saffron[bot]its-saffron[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

Remove hardcoded fallback credentials


2 participants

@itsmiso-ai@joryirving

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Remove hardcoded DATABASE_URL fallback from prisma.config.ts - #275
Merged
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
May 29, 2026
Merged
Remove hardcoded DATABASE_URL fallback from prisma.config.ts#275
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
Conversation
@itsmiso-ai
@itsmiso-aiitsmiso-ai
commented
May 29, 2026

Copy link


Copy Markdown

Contributor
Removes the hardcoded postgresql://localhost:5432/dispatch fallback from prisma.config.ts and requires DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded database connection string in committed source code, as flagged by the weekly tech debt audit.
Fixes#271
Jory Irving
Remove hardcoded DATABASE_URL fallback from prisma.config.ts
b846d55
Require DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded localhost
database connection string in committed source code.
its-saffron[bot]
its-saffronBot
approved these changes
May 29, 2026
View reviewed changes
@its-saffronits-saffronBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Automated Review
Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)
PR Review: Remove hardcoded DATABASE_URL fallback from prisma.config.ts
Recommendation: Approve
This PR correctly addresses issue #271 by eliminating the supply-chain risk of hardcoded database credentials in committed source code.
Change Summary
The diff modifies prisma.config.ts with two targeted changes:
  1. Expands validation scope: Changed if (process.env.NODE_ENV === "production" && !databaseUrl) to if (!databaseUrl) — now requires DATABASE_URL in all environments, not just production
  2. Removes fallback: Eliminated the ?? "postgresql://localhost:5432/dispatch" fallback from the datasource URL
Linked Issue Fit
Issue #271 RequirementPR ImplementationStatus
Remove hardcoded fallback credentials (dispatch:dispatch)Fallback removed entirely✅ Satisfied
Require DATABASE_URL to be set explicitlyCheck now throws in all environments✅ Satisfied
Eliminate supply-chain risk from error reports/screenshotsCredentials no longer in committed source✅ Satisfied
The PR follows the first recommendation from the issue (remove entirely) rather than the alternative placeholder approach.
Standards Compliance
Per AGENTS.md conventions:
  • ✅ No commit of secrets — Never commit .env files, node_modules, .next, or build output. This PR directly advances this goal by removing committed credentials.
  • ✅ Environment Variables — DATABASE_URL is documented as Yes (required) in the conventions. The new check enforces this contract.
Breaking Changes Assessment
Repository impact scan shows DATABASE_URL is properly set in:
  • .github/workflows/ci.yaml:25 — Sets DATABASE_URL for test environment
  • .github/workflows/image.yaml:67,76,77 — Sets DATABASE_URL for Docker image operations
  • Dockerfile:15,23 — ARG/ENV for build-time configuration
  • vitest.setup.ts:6 — Test setup has separate fallback for test database
CI and container builds are unaffected as they provide the variable explicitly. Local dev now requires .env configuration, which is the intended behavior.
Evidence Provider Findings
No evidence providers configured — no findings to report.
Tool Harness Findings
Tool harness planning failed to parse, but this is a single-file security fix with straightforward implementation. No harness execution was required.
Unknowns / Needs Verification
None. The implementation is straightforward, the issue is well-scoped, and the fix is internally consistent with repository conventions.
@joryirving
joryirving
merged commit 19b7d5a
into
mainMay 29, 2026

3 checks passed

@joryirving
joryirving
deleted the

fix/remove-hardcoded-db-credentials

branch
May 29, 2026 18:08
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@its-saffronits-saffron[bot]its-saffron[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

Remove hardcoded fallback credentials


2 participants

@itsmiso-ai@joryirving

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Remove hardcoded DATABASE_URL fallback from prisma.config.ts - #275
Merged
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
May 29, 2026
Merged
Remove hardcoded DATABASE_URL fallback from prisma.config.ts#275
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
Conversation
@itsmiso-ai
@itsmiso-aiitsmiso-ai
commented
May 29, 2026

Copy link


Copy Markdown

Contributor
Removes the hardcoded postgresql://localhost:5432/dispatch fallback from prisma.config.ts and requires DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded database connection string in committed source code, as flagged by the weekly tech debt audit.
Fixes#271
Jory Irving
Remove hardcoded DATABASE_URL fallback from prisma.config.ts
b846d55
Require DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded localhost
database connection string in committed source code.
its-saffron[bot]
its-saffronBot
approved these changes
May 29, 2026
View reviewed changes
@its-saffronits-saffronBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Automated Review
Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)
PR Review: Remove hardcoded DATABASE_URL fallback from prisma.config.ts
Recommendation: Approve
This PR correctly addresses issue #271 by eliminating the supply-chain risk of hardcoded database credentials in committed source code.
Change Summary
The diff modifies prisma.config.ts with two targeted changes:
  1. Expands validation scope: Changed if (process.env.NODE_ENV === "production" && !databaseUrl) to if (!databaseUrl) — now requires DATABASE_URL in all environments, not just production
  2. Removes fallback: Eliminated the ?? "postgresql://localhost:5432/dispatch" fallback from the datasource URL
Linked Issue Fit
Issue #271 RequirementPR ImplementationStatus
Remove hardcoded fallback credentials (dispatch:dispatch)Fallback removed entirely✅ Satisfied
Require DATABASE_URL to be set explicitlyCheck now throws in all environments✅ Satisfied
Eliminate supply-chain risk from error reports/screenshotsCredentials no longer in committed source✅ Satisfied
The PR follows the first recommendation from the issue (remove entirely) rather than the alternative placeholder approach.
Standards Compliance
Per AGENTS.md conventions:
  • ✅ No commit of secrets — Never commit .env files, node_modules, .next, or build output. This PR directly advances this goal by removing committed credentials.
  • ✅ Environment Variables — DATABASE_URL is documented as Yes (required) in the conventions. The new check enforces this contract.
Breaking Changes Assessment
Repository impact scan shows DATABASE_URL is properly set in:
  • .github/workflows/ci.yaml:25 — Sets DATABASE_URL for test environment
  • .github/workflows/image.yaml:67,76,77 — Sets DATABASE_URL for Docker image operations
  • Dockerfile:15,23 — ARG/ENV for build-time configuration
  • vitest.setup.ts:6 — Test setup has separate fallback for test database
CI and container builds are unaffected as they provide the variable explicitly. Local dev now requires .env configuration, which is the intended behavior.
Evidence Provider Findings
No evidence providers configured — no findings to report.
Tool Harness Findings
Tool harness planning failed to parse, but this is a single-file security fix with straightforward implementation. No harness execution was required.
Unknowns / Needs Verification
None. The implementation is straightforward, the issue is well-scoped, and the fix is internally consistent with repository conventions.
@joryirving
joryirving
merged commit 19b7d5a
into
mainMay 29, 2026

3 checks passed

@joryirving
joryirving
deleted the

fix/remove-hardcoded-db-credentials

branch
May 29, 2026 18:08
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@its-saffronits-saffron[bot]its-saffron[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

Remove hardcoded fallback credentials


2 participants

@itsmiso-ai@joryirving

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Remove hardcoded DATABASE_URL fallback from prisma.config.ts - #275
Merged
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
May 29, 2026
Merged
Remove hardcoded DATABASE_URL fallback from prisma.config.ts#275
joryirving merged 1 commit into
mainfrom 
fix/remove-hardcoded-db-credentials
Conversation
@itsmiso-ai
@itsmiso-aiitsmiso-ai
commented
May 29, 2026

Copy link


Copy Markdown

Contributor
Removes the hardcoded postgresql://localhost:5432/dispatch fallback from prisma.config.ts and requires DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded database connection string in committed source code, as flagged by the weekly tech debt audit.
Fixes#271
Jory Irving
Remove hardcoded DATABASE_URL fallback from prisma.config.ts
b846d55
Require DATABASE_URL to be set explicitly in all environments.
This eliminates the supply-chain risk of a hardcoded localhost
database connection string in committed source code.
its-saffron[bot]
its-saffronBot
approved these changes
May 29, 2026
View reviewed changes
@its-saffronits-saffronBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Automated Review
Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)
PR Review: Remove hardcoded DATABASE_URL fallback from prisma.config.ts
Recommendation: Approve
This PR correctly addresses issue #271 by eliminating the supply-chain risk of hardcoded database credentials in committed source code.
Change Summary
The diff modifies prisma.config.ts with two targeted changes:
  1. Expands validation scope: Changed if (process.env.NODE_ENV === "production" && !databaseUrl) to if (!databaseUrl) — now requires DATABASE_URL in all environments, not just production
  2. Removes fallback: Eliminated the ?? "postgresql://localhost:5432/dispatch" fallback from the datasource URL
Linked Issue Fit
Issue #271 RequirementPR ImplementationStatus
Remove hardcoded fallback credentials (dispatch:dispatch)Fallback removed entirely✅ Satisfied
Require DATABASE_URL to be set explicitlyCheck now throws in all environments✅ Satisfied
Eliminate supply-chain risk from error reports/screenshotsCredentials no longer in committed source✅ Satisfied
The PR follows the first recommendation from the issue (remove entirely) rather than the alternative placeholder approach.
Standards Compliance
Per AGENTS.md conventions:
  • ✅ No commit of secrets — Never commit .env files, node_modules, .next, or build output. This PR directly advances this goal by removing committed credentials.
  • ✅ Environment Variables — DATABASE_URL is documented as Yes (required) in the conventions. The new check enforces this contract.
Breaking Changes Assessment
Repository impact scan shows DATABASE_URL is properly set in:
  • .github/workflows/ci.yaml:25 — Sets DATABASE_URL for test environment
  • .github/workflows/image.yaml:67,76,77 — Sets DATABASE_URL for Docker image operations
  • Dockerfile:15,23 — ARG/ENV for build-time configuration
  • vitest.setup.ts:6 — Test setup has separate fallback for test database
CI and container builds are unaffected as they provide the variable explicitly. Local dev now requires .env configuration, which is the intended behavior.
Evidence Provider Findings
No evidence providers configured — no findings to report.
Tool Harness Findings
Tool harness planning failed to parse, but this is a single-file security fix with straightforward implementation. No harness execution was required.
Unknowns / Needs Verification
None. The implementation is straightforward, the issue is well-scoped, and the fix is internally consistent with repository conventions.
@joryirving
joryirving
merged commit 19b7d5a
into
mainMay 29, 2026

3 checks passed

@joryirving
joryirving
deleted the

fix/remove-hardcoded-db-credentials

branch
May 29, 2026 18:08
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@its-saffronits-saffron[bot]its-saffron[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

Remove hardcoded fallback credentials


2 participants

@itsmiso-ai@joryirving