security: Neon MCP leak fix + Codex MCP config + docs

[shadowdevcode]

Summary

• Security: Remove committed Neon API key from .mcp.json; gitignore local .mcp.json; add .mcp.json.example (see CHANGELOG).
• Codex: Add project-scoped .codex/config.toml with Neon HTTP MCP via NEON_API_KEY env var (no secrets in repo).
• Docs: CHANGELOG entries for security + Codex; project-state + Linear sync map updated for review.

Linear

• VIJ-11 (root issue-009): Done in Linear (verified 2026-04-04).
• Last Linear sync in experiments/linear-sync/issue-009.json remains phase-1-rollout-closeout (2026-04-04). These commits are repo/dev-env hygiene and do not change MoneyMirror delivery milestones—no separate Linear issue required unless you want a chore ticket.

Reviewer checklist

• Revoke leaked Neon key in Neon Console if not already done; use new key only in env / gitignored files.
• Confirm export NEON_API_KEY=... for Codex; copy .mcp.json.example → .mcp.json for Cursor/Claude if needed.

Made with Cursor

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ai-product-os-493e	Ready	Preview, Comment	Apr 4, 2026 10:32am

[github-actions]

PR Risk Assessment

Risk level: Low

Reason: Changes are scoped to developer tooling config (.codex/config.toml using env var, not hardcoded secret), .gitignore update, .mcp.json key rotation to placeholder, and CHANGELOG docs. No production code, auth logic, shared services, or schema changes touched.

Action taken: Auto-approve warranted (low risk) — blocked by GitHub Actions permission restriction; manual approval recommended.

[github-actions]

PR Risk Assessment

Risk level: Very Low

Reason: All changes are security remediation (leaked Neon key removed from .mcp.json, replaced with placeholder in renamed .mcp.json.example, .gitignore hardened), dev tooling config (.codex/config.toml using bearer_token_env_var, no secrets committed), and docs/state metadata updates (CHANGELOG.md, project-state.md, experiments/linear-sync/issue-009.json). No production code, auth logic, API routes, schemas, or shared libraries modified.

Action taken: Approved (auto-approval blocked by GitHub Actions restriction — manual approval required from a human reviewer)

[github-actions]

PR Risk Assessment

Risk level: Low

Reason: No production application code changed. Changes are a security fix (leaked Neon key redacted in .mcp.json.example + gitignored), a new dev tooling config (.codex/config.toml using bearer_token_env_var, no secrets), and docs/metadata housekeeping in CHANGELOG.md, project-state.md, and experiments/linear-sync/issue-009.json.

Action taken: Auto-approve attempted — blocked by GitHub Actions platform restriction (Actions cannot approve PRs). Manual approval recommended: low risk, no reviewer required.