diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..2cfd172
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-05-22 - [Insecure Production Defaults]
+**Vulnerability:** The application was configured to fall back to hardcoded "dev" credentials (e.g., 'dev-access-key') for critical services (AWS, SMTP) if the environment variables were missing in production.
+**Learning:** Checking `NODE_ENV === 'production'` is not enough; we must explicitly validate the presence of *all* required secrets to prevent silent failures or insecure fallbacks.
+**Prevention:** Maintain a strict `requiredProdVars` list in `env.config.ts` and ensure it covers all external service credentials.
diff --git a/backend/src/config/env.config.ts b/backend/src/config/env.config.ts
index fd0be76..98df5b8 100644
--- a/backend/src/config/env.config.ts
+++ b/backend/src/config/env.config.ts
@@ -199,6 +199,12 @@ if (envConfig.NODE_ENV === 'production') {
     'LUNES_RPC_URL',
     'CONTRACT_ADDRESS',
     'PRIVATE_KEY',
+    // Security: Prevent using dev defaults in production
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'SMTP_USER',
+    'SMTP_PASS',
+    'KYC_API_KEY',
   ];
 
   for (const varName of requiredProdVars) {