From 0bc50f3d5b77b5bbe9b9a9ee49a4048fa74ded46 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:03:46 +0000
Subject: [PATCH] bug: remove hardcoded API token from app.js

---
 app.js                        |  3 ---
 tests/hardcoded-token.test.js | 11 +++++++++++
 2 files changed, 11 insertions(+), 3 deletions(-)
 create mode 100644 tests/hardcoded-token.test.js

diff --git a/app.js b/app.js
index e7dfa39ffde..89f70ba2c14 100644
--- a/app.js
+++ b/app.js
@@ -80,9 +80,6 @@ if (app.get('env') == 'development') {
   app.use(errorHandler());
 }
 
-var token = 'SECRET_TOKEN_f8ed84e8f41e4146403dd4a6bbcea5e418d23a9';
-console.log('token: ' + token);
-
 http.createServer(app).listen(app.get('port'), function () {
   console.log('Express server listening on port ' + app.get('port'));
 });
diff --git a/tests/hardcoded-token.test.js b/tests/hardcoded-token.test.js
new file mode 100644
index 00000000000..e6e46f4392b
--- /dev/null
+++ b/tests/hardcoded-token.test.js
@@ -0,0 +1,11 @@
+var fs = require('fs');
+var path = require('path');
+var test = require('tap').test;
+
+test('no hard-coded API token is defined or logged in app.js', function (t) {
+  var app = fs.readFileSync(path.join(__dirname, '..', 'app.js'), 'utf8');
+  t.notMatch(app, /SECRET_TOKEN/, 'no token literal in app.js');
+  t.notMatch(app, /token\s*=\s*['"`]/, 'no token assigned from a literal');
+  t.notMatch(app, /console\.log\([^)]*token/i, 'no token written to the log');
+  t.end();
+});