Summary
The apps/api/src/lib/env.ts config object currently uses insecure dummy fallback values for critical environment variables (DATABASE_URL, BETTER_AUTH_SECRET, BETTER_AUTH_URL). This allows the application to start with invalid or insecure configuration.
Problem
Using fallback values like "dummy-secret-change-me" for the auth secret weakens session security. A predictable secret makes session tokens easier to forge.
Proposed Solution
Add a requireEnv helper that throws an informative error at boot time if a required environment variable is missing:
DATABASE_URL — required; no dummy fallbackBETTER_AUTH_SECRET — required; no dummy fallbackBETTER_AUTH_URL — required; no dummy fallbackPORT — optional, can default to 3000
References
/cc @silky-x0
Summary
The
apps/api/src/lib/env.tsconfig object currently uses insecure dummy fallback values for critical environment variables (DATABASE_URL,BETTER_AUTH_SECRET,BETTER_AUTH_URL). This allows the application to start with invalid or insecure configuration.Problem
Using fallback values like
"dummy-secret-change-me"for the auth secret weakens session security. A predictable secret makes session tokens easier to forge.Proposed Solution
Add a
requireEnvhelper that throws an informative error at boot time if a required environment variable is missing:DATABASE_URL— required; no dummy fallbackBETTER_AUTH_SECRET— required; no dummy fallbackBETTER_AUTH_URL— required; no dummy fallbackPORT— optional, can default to3000References
/cc @silky-x0