chore: scrub committed API keys + security baseline

CLAUDE.md

@@ -0,0 +1,34 @@
+# CLAUDE.md
+
+Guidance for AI agents (and humans) working in `mochi-api`.
+
+## What this is
+
+`mochi-api` is the core Go backend for Mochi (Console Labs): the Discord-bot API, token/NFT data, user/guild config, and on-chain helpers. Live on EKS `mochi-prod` (see Console Labs MAP.md). PUBLIC repo.
+
+- Module: `github.com/defipod/mochi` (legacy `defipod` path, see Notes), Go 1.19, gitflow (default branch `develop`).
+- Entrypoints: `cmd/server` (the API) plus many `cmd/*` workers/cron jobs (price watchers, streak updaters, nft balance sync, etc.).
+- Layout: `pkg/` (entities, handler, config, ...), `migrations/` (schema + seed), `abi/` (contract ABIs), `docs/` (swagger).
+
+## Commands
+
+- Build: `go build ./...` · Test: `go test ./...` (CI: `.github/workflows/ci-test.yml`)
+- Run API: `go run ./cmd/server`
+- Migrations: see `migrations/` (golang-migrate style)
+- Deploy: GKE workflows `.github/workflows/gke-dev.yml` / `gke-prod.yml`; release `release.yaml`
+
+## Conventions
+
+- Config via viper + env (`pkg/config/config.go`). Secrets come from env / the platform, NEVER hardcoded defaults (see Security).
+- Commit lint enforced (`.github/workflows/commitlint.yml`).
+- gitflow: feature branches off `develop`.
+
+## Security / quality (consolidation hardening pass, 2026-06-25)
+
+- **INCIDENT (rotate):** `pkg/config/config.go` previously hardcoded `SOLSCAN_TOKEN` (a JWT) and `BIRDEYE_API_KEY` as viper defaults in this PUBLIC repo. Both fields have since been removed entirely upstream (SolScan/Birdeye retired in favor of Alchemy). **The exposed keys must be rotated at SolScan and Birdeye if not already done** and are still in git history. See `docs/SECURITY-AUDIT-2026-06-25.md`.
+- Secret scan: `gitleaks detect -c .gitleaks.toml` (the release binary, no license needed). The allowlist excludes test fixtures / seed data / `.env.sample` (mock data, not secrets) so the gate fires on REAL leaks. CI: `.github/workflows/security.yml`.
+- Dependency audit: `govulncheck` runs in CI on a modern Go toolchain (`go-version: stable`; the module itself stays on Go 1.19). Dependabot is enabled. Bump deliberately; this is a live prod service.
+
+## Notes
+
+- The Go module path is still `github.com/defipod/mochi` (pre-consolidation). Renaming it to `github.com/consolelabs/...` is a BREAKING change (every importer + internal path) and is NOT done here; flagged as a follow-up so the org consolidation has no orphan `defipod` URLs.

README.MD

@@ -190,3 +190,23 @@ If you'd like to contribute, please check out the [contributing guide](CONTRIBUT
 
 - Reach us at [discord](https://discord.gg/dddsYkB8Jw).
 - Discuss development in the #build-with-us channel.
+
+
+<!-- consolidation-hardening: dev-docs -->
+## Development & docs
+
+This repo was reindexed in the Console Labs org-consolidation hardening pass (2026-06).
+
+- `CLAUDE.md` , guidance for AI agents + humans (stack, conventions, commands).
+- `docs/ARCHITECTURE.md` , what's here and how it fits together.
+- `docs/SECURITY-AUDIT-2026-06-25.md` , secret-scan + dependency baseline.
+- CI: `.github/workflows/security.yml` runs gitleaks + a dependency audit on every PR.
+
+Build / test:
+
+```
+go build ./...
+go test ./...
+```
+
+Secrets come from env / the platform, never hardcoded.

docs/ARCHITECTURE.md

@@ -0,0 +1,32 @@
+# mochi-api architecture
+
+Go backend for Mochi (Console Labs). One API server plus a fleet of cron/worker binaries, all in one module (`github.com/defipod/mochi`). Runs on EKS `mochi-prod`.
+
+```
+mochi-api/
+├── cmd/
+│   ├── server/                  the HTTP API (gin), main entrypoint
+│   └── <many workers>/          price watchers, streak/role/nft-balance updaters,
+│                                coingecko/binance fetchers, dm-notify, etc. (cron jobs)
+├── pkg/
+│   ├── handler/                 HTTP handlers (per domain: user, guild, token, ...)
+│   ├── entities/                business logic / service layer
+│   ├── config/                  viper + env config (config.go)
+│   ├── repo/ model/ ...         data access + models
+│   └── ...
+├── migrations/                  schema migrations + seed/ + test_seed/
+├── abi/                         on-chain contract ABIs
+└── docs/                        swagger + (this) architecture
+```
+
+## Shape
+
+- HTTP API (`cmd/server`) serves the Discord bot + web; the `cmd/*` workers run as scheduled jobs against the same DB/config.
+- Postgres (CNPG `pg-prod` per MAP.md) + Redis + Kafka. Config + secrets via viper/env (platform-injected).
+- Deploy: GKE workflows historically (`gke-dev`/`gke-prod`); current live runtime is EKS `mochi-prod`.
+
+## Notes for agents
+
+- Live prod service handling real user-facing data. Treat handler/entity changes as production changes; prefer additive, test with `go test ./...`.
+- Many worker binaries share `pkg/`; a change to a shared entity can affect both the API and the cron fleet.
+- Module path is legacy `defipod/*` (see SECURITY-AUDIT / CLAUDE.md); do not assume `consolelabs/*` import paths.

docs/SECURITY-AUDIT-2026-06-25.md

@@ -0,0 +1,34 @@
+# Security audit: mochi-api (2026-06-25)
+
+Bounded security triage from the Console Labs consolidation hardening pass. **This repo is PUBLIC.**
+
+## INCIDENT: two third-party API keys were hardcoded in a public repo (ROTATE)
+
+`pkg/config/config.go` set live secrets as viper DEFAULTS, committed to this public repo:
+
+| Key | line | type | action |
+|---|---|---|---|
+| `SOLSCAN_TOKEN` | 462 | SolScan API JWT | **ROTATE at SolScan**, then set via env only |
+| `BIRDEYE_API_KEY` | 463 | Birdeye API key | **ROTATE at Birdeye**, then set via env only |
+
+This PR originally scrubbed both to `""` (value sourced from env, as prod already does). By the time this PR rebased onto `develop`, both fields had already been removed from `pkg/config/config.go` upstream (the SolScan/Birdeye integrations were cut over to Alchemy), so no code change ships in the final diff. **The old values are still in git history** (removal only changes the working tree). Rotation is the real fix; a history rewrite is optional and secondary. The secret values are NOT reproduced anywhere in this repo or PR.
+
+- Owner action: rotate both keys at the providers if not already done; confirm no other consumer still relies on the retired defaults.
+- Pre-merge check: n/a, the fields no longer exist in config.go.
+
+## Secret scan: 49 -> 0 (after scrub + allowlist)
+
+`gitleaks detect --no-git` initially found 49 on this PR's original diff. Breakdown: 2 real (the config.go defaults above, since removed upstream) + 47 false positives in test fixtures / seed data / `.env.sample` (mock api-keys + mock discord-client-ids). `develop` has its own `.gitleaks.toml` allowlist covering the fixture paths and a `.github/workflows/security.yml` that runs the gitleaks binary directly (no license required) plus govulncheck on a modern Go toolchain; this PR keeps develop's versions of both rather than reintroducing its own.
+
+## Dependency audit
+
+`govulncheck` runs in CI (`develop`'s `security.yml`, `go-version: stable`). Dependabot is enabled on the repo. Findings are surfaced non-blocking until triaged; remediation is deliberate (live prod service).
+
+## Orphan defipod URL (flagged, not fixed)
+
+Go module path is `github.com/defipod/mochi` , a `defipod` reference inside a consolelabs repo. Renaming is a BREAKING change (all importers + internal imports) and is out of scope for this additive pass. Tracked so the consolidation's "no orphan defipod URLs" goal has a follow-up.
+
+## What this PR changes
+
+- No code change: the config.go scrub this PR proposed was superseded by an upstream removal of both fields, and the CI hardening (`.gitleaks.toml`, `.github/workflows/security.yml`) was superseded by develop's own fix for the same gitleaks-license and govulncheck-toolchain failures. Both kept as-is from develop.
+- Adds `CLAUDE.md`, `docs/ARCHITECTURE.md`, this record, and a README refresh.