[Dextheking1]

app.py fell back to a hardcoded dashboard password (admin / polymarket2024) and a fixed Flask secret key when the env vars were unset. Both values are in this public repo, so any deployment that forgets to set them is open to anyone. The control endpoints behind that login can start and stop the agent and turn auto-trading on.

Fix:

• No fallback password. If ADMIN_PASS is unset, a random one is generated for the run and printed once in the startup log.
• FLASK_SECRET_KEY falls back to a random per-run value, not a fixed string.
• Password check uses hmac.compare_digest.
• /api/analyze and /api/add_order now require auth too. Analyze spends money on AI calls and add_order writes state, neither should be open.
• deploy-tokyo.sh generates FLASK_SECRET_KEY and ADMIN_PASS when unset instead of shipping the known defaults.

Test: tests/test_no_default_credentials.py imports the app with both env vars unset and checks the old password is rejected and the two endpoints answer 401. Fails on the old code, passes here.

Note: the read endpoints (/api/positions, /api/agent/status, /api/logs and a few more) are still unauthenticated. Left them alone in this PR since the home page is marked public for demo, but they do expose live orders, positions and logs of a funded wallet. Worth a look.