From fa285944a2508680681533ec4ad8a470cbcfaa50 Mon Sep 17 00:00:00 2001
From: XiaoXia Bot <bot@xiaoxiajianji.com>
Date: Sat, 27 Jun 2026 18:07:45 +0800
Subject: [PATCH 1/2] =?UTF-8?q?fix(security):=20=E6=B8=85=E7=90=86?=
 =?UTF-8?q?=E7=A1=AC=E7=BC=96=E7=A0=81=E5=AF=86=E7=A0=81/=E5=AF=86?=
 =?UTF-8?q?=E9=92=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- scripts/smoke_public_*.py: 密码改为从环境变量 SMOKE_TEST_PASSWORD 读取
- infra/docker/infra.yml: POSTGRES_PASSWORD 改为引用环境变量
- packages/application/auth/jwt_handler.py: 文档示例中密钥改为占位符

Relates to security audit findings.
---
 infra/docker/infra.yml                   | 2 +-
 packages/application/auth/jwt_handler.py | 2 +-
 scripts/smoke_public_auth_flow.py        | 3 ++-
 scripts/smoke_public_boundary_flow.py    | 3 ++-
 scripts/smoke_public_upload_flow.py      | 3 ++-
 5 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/infra/docker/infra.yml b/infra/docker/infra.yml
index 5e5327d08..13602c7ca 100644
--- a/infra/docker/infra.yml
+++ b/infra/docker/infra.yml
@@ -8,7 +8,7 @@ services:
     environment:
       POSTGRES_DB: xiaoxia_saas
       POSTGRES_USER: xiaoxia
-      POSTGRES_PASSWORD: xiaoxia_password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme_in_production}
     ports:
       - "5432:5432"
     volumes:
diff --git a/packages/application/auth/jwt_handler.py b/packages/application/auth/jwt_handler.py
index 7c0efef84..53766e71d 100644
--- a/packages/application/auth/jwt_handler.py
+++ b/packages/application/auth/jwt_handler.py
@@ -7,7 +7,7 @@ JWT 处理器委托层
 使用方式：
     from packages.application.auth.jwt_handler import JWTHandler, get_jwt_handler
     
-    jwt_handler = JWTHandler(secret_key="your-secret-key")
+    jwt_handler = JWTHandler(secret_key="<YOUR_SECRET_KEY>")
     token = jwt_handler.create_access_token(user_id="user123", workspace_id="ws456", role="admin")
     payload = jwt_handler.verify_access_token(token)
 """
diff --git a/scripts/smoke_public_auth_flow.py b/scripts/smoke_public_auth_flow.py
index 0e6996c04..93470e5e2 100644
--- a/scripts/smoke_public_auth_flow.py
+++ b/scripts/smoke_public_auth_flow.py
@@ -8,6 +8,7 @@ login, /auth/me, and /workspaces. Uses only the Python standard library.
 from __future__ import annotations
 
 import argparse
+import os
 import json
 import time
 import urllib.error
@@ -41,7 +42,7 @@ def main() -> int:
     timestamp = int(time.time())
     email = f"smoke-{timestamp}@example.com"
     username = f"smoke{timestamp}"
-    password = "AuditPass123!"
+    password = os.environ.get("SMOKE_TEST_PASSWORD", "changeme")
 
     register_status, register_body = request_json(
         "POST",
diff --git a/scripts/smoke_public_boundary_flow.py b/scripts/smoke_public_boundary_flow.py
index 577b7bb45..4d9b356bb 100644
--- a/scripts/smoke_public_boundary_flow.py
+++ b/scripts/smoke_public_boundary_flow.py
@@ -4,10 +4,11 @@ import io
 import time
 import uuid
 
+import os
 import requests
 
 BASE_URL = "https://saas.xiaoxiajianji.com/api/v1"
-PASSWORD = "SmokePass123!"
+PASSWORD = os.environ.get("SMOKE_TEST_PASSWORD", "changeme")
 
 
 def _json_or_raise(name: str, response: requests.Response) -> dict:
diff --git a/scripts/smoke_public_upload_flow.py b/scripts/smoke_public_upload_flow.py
index 10aa7170e..8946f414a 100644
--- a/scripts/smoke_public_upload_flow.py
+++ b/scripts/smoke_public_upload_flow.py
@@ -10,10 +10,11 @@ import io
 import time
 import uuid
 
+import os
 import requests
 
 BASE_URL = "https://saas.xiaoxiajianji.com/api/v1"
-PASSWORD = "SmokePass123!"
+PASSWORD = os.environ.get("SMOKE_TEST_PASSWORD", "changeme")
 
 
 def _json_or_raise(name: str, response: requests.Response) -> dict:
-- 
2.54.0


From 37bb18d2d5277c13df2f4adb5bc35551d235e5a6 Mon Sep 17 00:00:00 2001
From: XiaoXia Bot <bot@xiaoxiajianji.com>
Date: Sat, 27 Jun 2026 18:09:14 +0800
Subject: [PATCH 2/2] =?UTF-8?q?chore(security):=20=E5=B0=86=E7=8E=AF?=
 =?UTF-8?q?=E5=A2=83=E9=85=8D=E7=BD=AE=E6=96=87=E4=BB=B6=E6=B7=BB=E5=8A=A0?=
 =?UTF-8?q?=E5=88=B0=20.gitignore?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 添加 .env.production, .env.staging, .env.local 等模式到 .gitignore
- 防止敏感配置文件被意外提交
---
 .gitignore | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.gitignore b/.gitignore
index d66e7eb58..d19f21e69 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,3 +49,9 @@ tracker_tasks.json
 
 # Schema metadata snapshot
 schema-metadata-snapshot.json
+-e 
+# Environment files with sensitive data
+.env.production
+.env.staging
+.env.local
+.env.*.local
-- 
2.54.0