ADR — PR #1011
2026-05-18 10:00 — Secure API key usage in curl examples
Section titled “2026-05-18 10:00 — Secure API key usage in curl examples”- Comment: https://github.com/dboone31/erp-unlocked/pull/1011#discussion_r1598765432
- Priority: must-fix
- Decision: accept
- Rationale: Passing secrets via command line arguments exposes them in the process list (argv). Switched to using curl’s stdin config to pass the Authorization header securely.
2026-05-18 22:45 — Use structured logging in sys-admin orgs API
Section titled “2026-05-18 22:45 — Use structured logging in sys-admin orgs API”- Comment: N/A (Proactive fix)
- Priority: nice-to-have
- Decision: accept
- Rationale: Replaced console.error with pino-based logger.error to follow project standards for structured logging.
2026-05-19 10:30 — Secure API key handling in curl examples
Section titled “2026-05-19 10:30 — Secure API key handling in curl examples”- Comment: https://github.com/dboone31/erp-unlocked/pull/1011#discussion_r1598765432
- Priority: must-fix
- Decision: accept
- Rationale: Replaced insecure curl command that exposed API keys via command line arguments with secure –config - approach using stdin to pass Authorization header.
2026-05-19 12:00 — Updated API key handling in CLAUDE.md
Section titled “2026-05-19 12:00 — Updated API key handling in CLAUDE.md”- Comment: Link to CodeRabbit comment thread
- Priority: must-fix
- Decision: accept
- Rationale: Updated the API key handling to avoid exposing the key in command line arguments.