From 63eda48aa722792e169ea29b4056d7dfbf142446 Mon Sep 17 00:00:00 2001 From: jaxperro Date: Wed, 8 Jul 2026 17:27:33 -0400 Subject: [PATCH] =?UTF-8?q?HANDOFF:=20Alchemy=20key=20rotated=20=E2=80=94?= =?UTF-8?q?=20no=20standing=20to-dos=20remain?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Old app (leaked key ...OdWgOi) deleted, new app wwf-rpc-2026-07 (...w0BxV5) wired into config.json + ALCHEMY_RPC_URL secret. Old key verified dead (401), new key live, bot copying, Notify webhook intact. Co-Authored-By: Claude Fable 5 --- HANDOFF.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/HANDOFF.md b/HANDOFF.md index b3694297..7fa3fde1 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -62,10 +62,14 @@ automated. ## Standing to-dos (user-only or external) -- **ROTATE THE LEAKED ALCHEMY KEY** (config.live.example.json git history). - New key at dashboard.alchemy.com → update gitignored `config.json` AND - `flyctl secrets set ALCHEMY_RPC_URL=...`. This is the LAST standing to-do. - (Railway project deleted 2026-07-08; purges 2026-07-10.) +- **None open.** Alchemy key ROTATED 2026-07-08: old app "Jax's First App" + (key `…OdWgOi`, the one leaked to public git history) deleted; new app + `wwf-rpc-2026-07` (key `…w0BxV5`) wired into gitignored `config.json` + + the `ALCHEMY_RPC_URL` Fly secret. Verified: old key → HTTP 401 (the key + in git history is now dead, so no history rewrite needed), new key serves + Polygon, bot rebooted with settle-fallback ON and made a live copy, Notify + webhook `wh_blf4qjjvfdbqs9mc` survived (app-delete doesn't touch Notify + resources) — 7 addresses in sync. Railway project deleted (purges 07-10). ## Operational quick-reference