🛡️ Sentinel: [CRITICAL] Fix Insecure Production Defaults

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-22 - [Insecure Production Defaults]
+**Vulnerability:** The application was configured to fall back to hardcoded "dev" credentials (e.g., 'dev-access-key') for critical services (AWS, SMTP) if the environment variables were missing in production.
+**Learning:** Checking `NODE_ENV === 'production'` is not enough; we must explicitly validate the presence of *all* required secrets to prevent silent failures or insecure fallbacks.
+**Prevention:** Maintain a strict `requiredProdVars` list in `env.config.ts` and ensure it covers all external service credentials.

backend/src/config/env.config.ts

@@ -199,6 +199,12 @@ if (envConfig.NODE_ENV === 'production') {
     'LUNES_RPC_URL',
     'CONTRACT_ADDRESS',
     'PRIVATE_KEY',
+    // Security: Prevent using dev defaults in production
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'SMTP_USER',
+    'SMTP_PASS',
+    'KYC_API_KEY',
   ];
 
   for (const varName of requiredProdVars) {