Security: Predictable default administrator credentials

[mssystem1]

Summary

The application automatically creates an administrator account using publicly documented default credentials.

According to the README, the default administrator account is:

• Email: admin@admin.com
• Password: 123456

The same README states that this account has access to the Admin Dashboard, including users, wallets, and transaction information.

If a deployment is publicly accessible before these credentials are changed, anyone familiar with the repository can obtain administrator access.

Affected file(s)

README.md

https://github.com/circlefin/arc-commerce/blob/master/README.md#admin-account

Steps to reproduce

1. Deploy the application following the README.
2. Do not modify the automatically created administrator account.
3. Open the login page.
4. Sign in using:

Email: admin@admin.com
Password: 123456

5. Verify access to the Admin Dashboard.

Expected behavior

Administrator accounts should not be created with predictable credentials.

Production deployments should require deployment-specific administrator credentials or a secure first-run initialization flow.

Actual behavior

A privileged administrator account is created using publicly documented default credentials.

Impact

A publicly exposed deployment may allow unauthorized users to:

• Access administrator functionality
• View user information
• View wallet information
• View transaction history
• Perform privileged administrative actions

Suggested fix

• Remove the default administrator password.
• Require administrator credentials through environment variables or a first-run setup wizard.
• Generate a random one-time password if automatic initialization is required.
• Reject common default passwords.
• Disable automatic administrator creation outside local development.

Checklist

• Remove default administrator credentials
• Require deployment-specific administrator initialization
• Reject known default passwords
• Disable insecure defaults in production
• Update documentation

[kutluhaneth46]

Opened #59 — ADMIN_EMAIL + ADMIN_PASSWORD from env; production blocks documented defaults.