SecurityLow

Service Account Env Fallback

lib/config.ts:3

What's going on

A development service account lives in a committed env fallback used when CI lacks real credentials.

Why it matters

Even throwaway credentials multiply exposure surface; rotate and remove them.

lib/config.ts:3

Recommended Fix

Replace the inline query with a parameterized statement and validate the id before it ever reaches the database. A regression test is generated alongside the patch.

Before

1const key = process.env.SERVICE_KEY || "dev-service-account";

After

1const key = envRequired("SERVICE_KEY"); // fails fast in prod/CI

Uploaddone
Analyzedone
Finddone
Explainactive
Fixupcoming
Testupcoming
Verifyupcoming