From de3ee06259f7cb96d9abb37be27ff9b4f2a977ab Mon Sep 17 00:00:00 2001
From: Coupon Carl <coupon-carl@cartsnitch.com>
Date: Sat, 28 Mar 2026 10:03:39 +0000
Subject: [PATCH] fix: fail fast if BETTER_AUTH_SECRET is not set

Remove hardcoded fallback secret that allowed sessions to be
signed with a well-known value if the env var was unset.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 src/auth.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/auth.ts b/src/auth.ts
index 33a0e05..1215cdb 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -10,10 +10,15 @@ const pool = new Pool({
     "postgresql://cartsnitch:cartsnitch@localhost:5432/cartsnitch",
 });
 
+const secret = process.env.BETTER_AUTH_SECRET;
+if (!secret) {
+  throw new Error("BETTER_AUTH_SECRET environment variable is required");
+}
+
 export const auth = betterAuth({
   database: pool,
   basePath: "/auth",
-  secret: process.env.BETTER_AUTH_SECRET ?? "change-me-in-production-min-32-chars!!",
+  secret,
   baseURL: process.env.BETTER_AUTH_URL ?? "http://localhost:3001",
 
   emailAndPassword: {