From d9c37af6420d02b5e6c43e5fb13a29b50accabdc Mon Sep 17 00:00:00 2001
From: Rene Fichtmueller <rf@flexoptix.net>
Date: Mon, 6 Jul 2026 10:16:27 +0200
Subject: [PATCH] fix(security): remove hardcoded DB password from
 run-atgbics-mac.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The script hardcoded the pre-rotation POSTGRES_PASSWORD (retired 2026-06-04,
already invalid). Source the current password from ~/.tip/.env (git-ignored,
exported) instead — same pattern as the FS.com residential runner.
---
 scripts/run-atgbics-mac.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/run-atgbics-mac.sh b/scripts/run-atgbics-mac.sh
index 806ca7b..051d17c 100755
--- a/scripts/run-atgbics-mac.sh
+++ b/scripts/run-atgbics-mac.sh
@@ -40,13 +40,14 @@ if [[ ! -f "$REPO_DIR/packages/scraper/dist/scrapers/atgbics.js" ]]; then
   cd "$REPO_DIR/packages/scraper" && npm run build
 fi
 
+# Load current DB password (not hardcoded — post-rotation secret lives in ~/.tip/.env)
+[ -f "$HOME/.tip/.env" ] && set -a && source "$HOME/.tip/.env" && set +a
 # Run scraper
 echo "Running ATGBICS scraper..."
 cd "$REPO_DIR"
 POSTGRES_HOST=127.0.0.1 \
 POSTGRES_PORT="${TUNNEL_PORT}" \
 POSTGRES_USER=tip \
-POSTGRES_PASSWORD=***REDACTED*** \
 POSTGRES_DB=transceiver_db \
 node packages/scraper/dist/scrapers/atgbics.js 2>&1 | tee "$LOG"