bug: remove hardcoded API token from app.js

[devin-ai-integration]

Summary

app.js declared a hardcoded API token and printed it on every startup (CWE-798):

-var token = 'SECRET_TOKEN_[REDACTED]';
-console.log('token: ' + token);

The variable was never referenced anywhere else, so the credential is simply removed — no configuration/env plumbing is needed. The literal was public in git history, so it should be considered compromised and rotated wherever it was issued.

tests/hardcoded-token.test.js (tap) guards against reintroduction: asserts app.js contains no SECRET_TOKEN, no token assigned from a string literal, and no console.log of a token.

Note on provenance: the scan finding that prompted this was filed against COG-GTM/2025-Federal-Agency-AI-Use-Case-Inventory, but that repo contains only CSV/XLSX/PDF inventory data and no credentials; the finding's source row points at nodejs-goof, where the hardcoded token actually lives.

---

Written by Devin

Devin-Org: engineering