[sh1pt-actions-fleet]

Fleet rule 2026-10-28 (dev2 wallet drain). The deployer wallet key was read from PRIVATE_KEY in env/.env (hardhat.config.js, check-address, deploy-phantom) or argv (prefund-contract).

• scripts/lib/deployer-key.js: the key comes from logicsrc keyring restore $DEPLOYER_KEYRING --print-private (keyring passphrase asked on the terminal) or a hidden /dev/tty prompt; a PRIVATE_KEY left in env is refused. Cached per process only, never written.
• hardhat.config.js: live networks (sepolia, mainnet, base, arbitrum) resolve the key only when that network is selected; compile/test/localhost never ask.
• prefund-contract.js no longer takes the key as an argument (usage is now <network> [amount]).
• .env.example / setup-deployment.js: DEPLOYER_KEYRING instead of PRIVATE_KEY.

Contract and addresses untouched (ownership moved today; no rotation here). No deploy: scripts only.

Tests: test/deployer-key.test.js (no prompt without a live network, network selection, env refused). Verified hardhat help loads without asking and --network sepolia without a TTY stops with the keyring hint.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

16 finding(s)

MEDIUM: 6 | LOW: 10

Severity	Rule	Location
MEDIUM	js-open-redirect	src/lib/components/Header.svelte:76
MEDIUM	js-open-redirect	src/lib/components/Header.svelte:86
MEDIUM	js-open-redirect	src/lib/components/WalletConnect.svelte:148
MEDIUM	js-jwt-decode-without-verify	src/lib/server/jwt-auth-secure.js:362
MEDIUM	js-jwt-decode-without-verify	src/lib/server/jwt-auth-secure.js:377
MEDIUM	js-open-redirect	src/lib/utils/notifications.js:82
LOW	secret-generic-credential	tests/client-auth.test.js:312
LOW	secret-generic-credential	tests/reveal-confirmation-fix.test.js:138
LOW	secret-generic-credential	tests/reveal-confirmation-fix.test.js:187
LOW	secret-generic-credential	tests/reveal-confirmation-fix.test.js:270
LOW	secret-generic-credential	tests/server-side-auth-api.test.js:177
LOW	secret-generic-credential	tests/server-side-auth-api.test.js:268
LOW	secret-generic-credential	tests/server-side-auth-api.test.js:376
LOW	secret-generic-credential	tests/server-side-auth-api.test.js:377
LOW	secret-jwt	tests/test-wallet-ambiguity-fix.js:7
LOW	secret-jwt	tests/wallet-address-ambiguity-fix.test.js:8

Snippets are redacted; ThreatCrush never prints matched credential material.