services/backend's AppConfig::from_env() requires JWT_SECRET and DATABASE_URL (good — fails fast if unset), but doesn't validate that JWT_SECRET isn't the .env.example placeholder value (dev-only-change-me) before starting in a non-local environment. It would be easy to deploy to Railway/Render (#9) and forget to override it.
To do: either reject JWT_SECRET=dev-only-change-me outright at startup, or warn loudly (tracing::warn!) when RUST_LOG/env doesn't indicate a local/dev environment.
services/backend'sAppConfig::from_env()requiresJWT_SECRETandDATABASE_URL(good — fails fast if unset), but doesn't validate thatJWT_SECRETisn't the.env.exampleplaceholder value (dev-only-change-me) before starting in a non-local environment. It would be easy to deploy to Railway/Render (#9) and forget to override it.To do: either reject
JWT_SECRET=dev-only-change-meoutright at startup, or warn loudly (tracing::warn!) whenRUST_LOG/env doesn't indicate a local/dev environment.