From 3648b0da4016857d16beb8674a3723bfc07262ad Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 20 Feb 2026 21:50:55 +0000
Subject: [PATCH] fix(security): remove default credentials from example config

Removes the hardcoded `auth: "admin:password"` from `torch-config.example.json` to prevent users from accidentally deploying with insecure defaults.

Adds a regression test `test/verify-example-config-security.test.mjs` to ensure the example config does not contain default credentials in the future.

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 test/verify-example-config-security.test.mjs | 14 ++++++++++++++
 torch-config.example.json                    |  3 +--
 2 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 test/verify-example-config-security.test.mjs

diff --git a/test/verify-example-config-security.test.mjs b/test/verify-example-config-security.test.mjs
new file mode 100644
index 0000000..dcbe3f4
--- /dev/null
+++ b/test/verify-example-config-security.test.mjs
@@ -0,0 +1,14 @@
+import test from 'node:test';
+import assert from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+
+test('torch-config.example.json Security', (t) => {
+  const configPath = path.resolve('torch-config.example.json');
+  const content = fs.readFileSync(configPath, 'utf8');
+  const config = JSON.parse(content);
+
+  if (config.dashboard) {
+      assert.strictEqual(config.dashboard.auth, undefined, 'Example config should not contain auth field');
+  }
+});
diff --git a/torch-config.example.json b/torch-config.example.json
index aafd0bf..df7ea44 100644
--- a/torch-config.example.json
+++ b/torch-config.example.json
@@ -18,8 +18,7 @@
   },
   "dashboard": {
     "defaultCadenceView": "daily",
-    "defaultStatusView": "active",
-    "auth": "admin:password"
+    "defaultStatusView": "active"
   },
   "scheduler": {
     "firstPromptByCadence": {