What's pending across every project
3 open · sorted by priority then due-date
blocker
urgent
Revoke exposed GitHub PAT shared in chat session
RoadIntelix
· roadintelix
· by Prajith
from the conversationprajith: [shared GitHub PAT in chat to clone private repo]\nclaude: Please revoke this token immediately — GitHub Settings → Developer settings → Fine-grained tokens → delete it.
51d ago
06-18 04:24
06-18 04:24
todo
urgent
Rotate Razorpay webhook secret — 'hopewell' is guessable
The RAZORPAY_SECRET_WEBHOOK value in /opt/ocpp/.env on the production VM is literally 'hopewell' — a common English word, effectively no protection. HMAC verification against a guessable secret means anyone who learns the plaintext can forge webhook calls and credit any wallet.
Fix:
1. Razorpay Dashboard → Settings → Webhooks → regenerate a long random secret (32+ char base64).
2. Update /opt/ocpp/.env on the VM (SMTP_PASSWORD-style edit).
3. sudo systemctl restart ocpp.service.
4. Send a test webhook from Razorpay dashboard and confirm it verifies.
This is the single most impactful hardening we can do.
/opt/ocpp/.envinternal/handlers/wallet_handler.go:239-254↗ https://dashboard.razorpay.com/app/webhooks
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
from the conversationclaude: RAZORPAY_SECRET_WEBHOOK=hopewell in .env is weak - anyone who guesses the plaintext can forge webhooks (i.e., forge topups). Regenerate a long random secret in the Razorpay dashboard and update .env, then restart the service. This is the single most impactful hardening you can do.
saravanan: put them in my project tracker - scrumclaw.ai
8d ago
07-31 02:51
07-31 02:51
blocker
urgent
Enable Razorpay QR Codes product on merchant account
The Razorpay QR Codes API (`POST /v1/payments/qr_codes`) requires activation on your merchant account. Ping Razorpay support: "Please enable Payment Handle / QR Codes API on account acc_XXXX". Typically enabled within 24–48 hours, no additional cost for UPI QR.
Confirmed during BRD Q15 as "not enabled". Blocks Phase 1 pilot — we can build the backend, but cannot create even the first test QR without this.</body>
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
6d ago
08-02 11:44
08-02 11:44