sam-4screen-desktop 2026-10-7:18:6:28

000 daily/Daily Notes and To Do.md

@@ -30,7 +30,17 @@ tags:
 - [ ] 
 - [ ] Fix dualis lights
 - [ ] Fix Prado lights
-- [ ] Enter competition before August 31 https://www.seeedstudio.com/make-a-sign-interactive-signage-contest-2026 
+- [ ] Enter competition before August 31 https://www.seeedstudio.com/make-a-sign-interactive-signage-contest-2026
+
+- [ ] **🔐 Rotate the shared lab password exposed in the public Gitea `sam/voice_bridge` repo** — commit `edaf914` (since force-rewritten; Gitea verified clean) but **the value is still live and unrotated**
+	- [ ] **Blocked on hardware:** ~6+ ESP32 devices bake it into firmware (`voice_assistant/config.h` → `MQTT_USER`/`MQTT_PASS`) — needs a coordinated reflash plan
+	- [ ] Reused in ~21 files on `.13`: Pi-hole (`setupVars.conf`), nebula-sync, MQTT broker, **n8n DB**, ai-resume stack, langfuse, t3_stack_react, sams-home-network, `voice-agent/.env`
+	- [ ] Change it **everywhere in one pass**, and stop reusing one value across unrelated systems
+	- [ ] Purge local `voice_bridge` git history (`.13:/home/sam/voice_bridge` still holds `edaf914`) before any full push, or the exposure returns
+	- [ ] Value is deliberately **not** written here — this vault is a synced git repo
+- [ ] **`voice_bridge`: untrack `venv/`** — 13,413 files tracked, repo is 217 MB. A `.gitignore` exists but has no `venv/` entry, and gitignore alone won't shrink it (`git rm -r --cached venv/` + history rewrite needed)
+- [ ] Verify Gitea secret-scanning / push-protection is actually enabled — this password reached a **public** repo, so either it predates the controls or they aren't working
+
 
 ## 🎯 Focus Areas