Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·29 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhookBlocked · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditDone Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerBlocked Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)To do runs.tactile.to is on the open internet behind only an app passwordTo do Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryDone Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

20/29 done9 open3 open blockers

Selected taskclear

DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhook

BlockedOwner · met_538bf07bBlocker

Found 2026-10-05 while preparing t_90e27a65. scripts/secrets/rotations/stripe.live_webhook_secret.mjs is armed and pushes the wrong secret names, then deletes the old live endpoint.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhook** · blocked · blocker

Found 2026-10-05 while preparing t_90e27a65. scripts/secrets/rotations/stripe.live_webhook_secret.mjs is armed and pushes the wrong secret names, then deletes the old live endpoint.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## The brief on file

[2026-10-05 · Viv] Found while preparing t_90e27a65 (staging Stripe test webhook). Not changed: it is live-mode tooling and cannot be tested here.

DECISION: Disarm or fix scripts/secrets/rotations/stripe.live_webhook_secret.mjs before anyone runs `pnpm secrets:rotate Stripe live_webhook_secret`?
RECOMMEND: Yes, disarm now (delete its arming sentinel or gate it on an explicit flag), then fix it in a reviewed PR. Until then, rotate the live webhook secret only by the manual path in draft PR #657.
COST IF YES: about 30 minutes of agent work for a fix PR. The fix must be reviewed by Matthew because it is live-mode Stripe tooling.
COST IF NO: if anyone runs it as written, prod billing breaks silently. The script pushes STRIPE_WEBHOOK_SECRET and STRIPE_WEBHOOK_SECRET_PENDING (the API reads STRIPE_WEBHOOK_SIGNING_SECRET; see lines 120, 131, 134). It also subscribes the new endpoint to the wrong events, and deletes the old live endpoint. Prod would then reject every Stripe webhook, so renewals, cancellations and domain suspend/reinstate would stop being processed.
FLAGS: money (live Stripe), irreversible (deleting the live endpoint)
DRAFT: no code changed. Manual rotation path: draft PR #657 (docs/runbooks, Android upload-key regen + rotation night).

Evidence: reported by the t_90e27a65 prep agent, which read the script and found the sentinel file present. Re-verify the line numbers before acting.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhook