From b3bb2f13b74b0bcae04adc037265353de13a6f00 Mon Sep 17 00:00:00 2001
From: Sterling Archer <SterlingArcher2026@icloud.com>
Date: Thu, 18 Jun 2026 16:25:59 -0700
Subject: [PATCH] Remove adminSecret from client, move to server-side only

---
 config.js  | 3 +--
 index.html | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/config.js b/config.js
index f19895b..411b9fc 100644
--- a/config.js
+++ b/config.js
@@ -8,7 +8,6 @@ window.STEPMATES_CONFIG = {
     appId: "1:334532615980:web:84cd9b35341dda869fd689"
   },
   webhookBase: "https://webhook-mgc3i5pbxq-uc.a.run.app",
-  adminNotifyUrl: "https://us-central1-step-tracker-bfd5c.cloudfunctions.net/adminNotify",
-  adminSecret: "YOUR_ADMIN_SECRET",
+  adminNotifyUrl: "https://adminnotify-mgc3i5pbxq-uc.a.run.app",
   appUrl: "https://justinoros.github.io/step-tracker"
 };
diff --git a/index.html b/index.html
index 2ab1182..1b06bc8 100644
--- a/index.html
+++ b/index.html
@@ -1676,7 +1676,7 @@ async function initUser(user) {
 
 async function notifyAdminOfNewUser(email, uid) {
   try {
-    await fetch(`${window.STEPMATES_CONFIG.adminNotifyUrl}?uid=${uid}&email=${encodeURIComponent(email)}&secret=${window.STEPMATES_CONFIG.adminSecret}`);
+    await fetch(`${window.STEPMATES_CONFIG.adminNotifyUrl}?uid=${uid}&email=${encodeURIComponent(email)}`);
   } catch(e) {
     console.warn('Admin notify failed', e);
   }