[Arsh-S]

Summary

Heroku Scheduler prints each job command to the logs with env vars already expanded, so the current curl ... -H "Authorization: Bearer $SUPABASE_SERVICE_KEY" jobs leak the service key into heroku logs on every run.

This adds backend/scripts/cron.sh <payment-reminders|pickup-reminders>. The script reads SUPABASE_SERVICE_KEY from the dyno environment and calls the matching /api/order/cron/* route, so the Scheduler command becomes bash backend/scripts/cron.sh payment-reminders and nothing sensitive hits the logs. It prints the HTTP status and exits non-zero on anything but 2xx so failed runs show up in Scheduler.

CRON_BASE_URL can override the backend URL for testing.

How to test

CRON_BASE_URL=https://httpbin.org/anything SUPABASE_SERVICE_KEY=dummy bash backend/scripts/cron.sh pickup-reminders

prints cron pickup-reminders -> HTTP 200. Running with no argument or a bad route exits 2 with a usage line; running without the key exits with an error.

After merge, repoint the Scheduler jobs on curaise-app to the new command.

Checklist

• Targets main
• No .env* files, keys, or real user data in the diff
• I read every line of this diff and can explain it in review

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
curaise	Ready	Preview	Oct 31, 2026 8:18pm UTC

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: 62ad6534-e26b-41a5-b473-1cdde2ea7311

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn