Move hardcoded 'rootpassword' default in parser/{config,backfill_changeover, clmparser,udcparser}.py behind os.environ.get('SHOPDB_DB_PASSWORD', 'rootpassword'). Add defensive patterns (.env, *.key, *.pem, id_rsa*, secrets.*, etc.) to .gitignore across all project repos. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>