feat(#109): Security hardening - secrets, JWT, and pre-beta config Th… - #171
Merged
0xdevcollins merged 2 commits intoJul 31, 2026
Merged
Conversation
…ta config This commit implements Issue 0xdevcollins#109 requirements: - Create secret generation script (scripts/generate-secrets.sh) * Generates JWT_SECRET, API_KEY_SALT, BANK_SESSION_ENCRYPTION_KEY, BANK_WEBHOOK_SECRET * Uses openssl for cryptographically secure random values * Executable and includes guidance for manual secret setup - Sanitize environment configuration * Clean .env.example of hardcoded private keys * Replace with safe placeholders (S..., 0x..., C..., your-*) * Add comprehensive inline documentation (60+ lines) - Add startup environment validation * New module: apps/api/src/common/config/env-validation.ts * Validates critical variables before API starts * Detects missing required secrets * Detects placeholder values using regex patterns * Halts startup with clear error messages * Integration in main.ts bootstrap function - Update documentation * README.md: Add Pre-Beta Environment Setup Guide (350+ lines) - Document 50+ environment variables - Include sources and how to obtain each secret - Setup by stage (local, beta, production) - Links to external service portals - Troubleshooting guide * Create SECURITY_HARDENING_IMPLEMENTATION.md - Implementation summary - Verification of acceptance criteria - Pre-release checklist - Security notes Acceptance Criteria Met: ✅ scripts/generate-secrets.sh exists and is executable ✅ No hardcoded private keys in tracked files ✅ .env.example sanitized with helpful placeholders ✅ main.ts validates critical environment secrets ✅ Validation fails on placeholder or missing values ✅ README.md contains comprehensive Pre-Beta guide ✅ All acceptance criteria verified
|
Someone is attempting to deploy a commit to the Threadflow Team on Vercel. A member of the Team first needs to authorize it. |
|
@fairbid01 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
- Strip base64 line wrapping in generate-secrets.sh so JWT_SECRET is a single-line value instead of a corrupted two-line entry - Gate chain hot-wallet keys (STELLAR_RELAY_KEYPAIR_SECRET, EVM_RELAY_PRIVATE_KEY) on NODE_ENV=production so local development and CI can boot without provisioning real wallets; placeholder detection still applies everywhere - Throw EnvValidationError instead of calling process.exit inside the validator; main.ts catches it, logs via Nest Logger, and exits - Remove API_KEY_SALT from the script, example, README, and validation: API keys are hashed with bcrypt (embedded salts) and no code reads it - Fix misleading 'placeholder or missing' error wording and collapse redundant placeholder patterns into the generic ones - Add unit tests for isPlaceholder and validateEnvironmentConfig - Remove SECURITY_HARDENING_IMPLEMENTATION.md: it claimed hardcoded private keys were removed, but .env.example only ever contained placeholders; the setup guidance lives in README and .env.example
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements Issue #109 (pre-beta security hardening):
scripts/generate-secrets.shgenerates JWT_SECRET, BANK_SESSION_ENCRYPTION_KEY, and BANK_WEBHOOK_SECRET via openssl (single-line, .env-safe output) and lists the secrets that need manual setup (Stellar/EVM keys, Stripe, Circle, Resend, Cloudinary).apps/api/src/common/config/env-validation.tsvalidates critical env vars before boot: required vars must be set, no variable may remain at a.env.exampleplaceholder value, and JWT_SECRET has a minimum length. Chain hot-wallet keys are required only whenNODE_ENV=production, so local development and CI boot without provisioning real wallets. Validation throws a typedEnvValidationError;main.tslogs it and exits..env.exampledocumentation — each variable now documents its purpose, format, and where to obtain it.API_KEY_SALTwas removed: API keys are hashed with bcrypt (which embeds its own salts) and nothing in the codebase reads that variable.Note:
.env.examplepreviously contained only placeholder values (S...,0x...,your-*) — no real secrets were ever tracked, so this PR documents and enforces good hygiene rather than remediating a leak.Closes #109