fix: remove Stripe placeholder secret defaults; reconcile stale audit docs

[groupthinking]

Canonical issue

Closes #1126

Outcome

The .env.example generator no longer emits placeholder-looking secrets (sk_test_..., pk_test_..., whsec_...) when Stripe keys are absent — it emits empty values, matching _generate_env_local. The Dec-2025 audit docs no longer misreport resolved findings as open: each carries a dated resolution-status banner with code evidence, and the readiness verdict moves from the stale 57.5/100 🔴 NO-GO to 73/100 🟡 CONDITIONAL (security cleared; operational gaps remain).

Scope

• Included: Stripe default fix in ai_code_generator.py; resolution-status banners in docs/analysis/{SECURITY_REPORT,REMEDIATION_PLAN,EXECUTIVE_SUMMARY,PRODUCTION_CHECKLIST}.md; supersession note in docs/NPM_VULNERABILITIES.md; stale CHANGELOG follow-up note corrected.
• Explicitly excluded: re-remediating already-fixed findings (pickle, subprocess, XSS, devalue/next chain — all verified fixed in current code); fixing the 4 new unrelated npm audit advisories (ip-address, postcss — noted in docs, fixable via npm audit fix); CI coverage config (already enforced via fail_under = 88.1833 in pyproject.toml + coverage.yml).

Risk

• Risk level: low
• Failure mode: generated .env.example now has empty Stripe values instead of placeholders when env keys are unset.
• Rollback: revert the two commits.

Verification

• Focused tests: pytest tests/unit/test_ai_code_generator.py — 253 passed
• Every doc claim re-verified against current code (no pickle imports in src/youtube_extension/, no frontend/ dir or dangerouslySetInnerHTML, list-form subprocess calls, devalue absent from lockfile, next resolves 16.2.12, npm audit re-run to scope SEC-002 accurately)
• Required CI

Production evidence

Not applicable — code path only affects generated .env.example scaffolding; remaining changes are documentation.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

[linear-code]

GRV-194

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, v0	Aug 29, 2026 7:53am

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 83d4c895-e4f4-4d44-b720-acee7c519e79

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ec6a23d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: invalid_payload

Machine-readable verdict

{
  "details": {
    "collection_errors": [
      "incomplete_linked_issue_contract",
      "missing_intent_snapshot",
      "missing_agent_run_id",
      "missing_agent_login"
    ],
    "invalid_fields": [
      "policy.agent_login",
      "policy.run_id"
    ]
  },
  "reasons": [
    "invalid_payload"
  ],
  "verdict": "blocked"
}

Workflow evidence