Environment variables are documented

An undocumented environment variable is a reference to something that may not exist on the deployment target. CWE-798 covers hardcoded credentials, but the inverse failure — a credential variable that is referenced but never defined — is equally damaging: on a fresh Vercel or Railway deploy, process.env.STRIPE_SECRET_KEY is undefined, and the Stripe client silently initializes with no key, causing every payment request to fail with a confusing API error rather than a startup crash. OWASP A05 (Security Misconfiguration) covers this class of deployment-time misconfiguration. The env-vars-documented check enforces reference-integrity between code and its runtime configuration contract.

Document every non-platform env var in .env.example and add a typed validation schema so missing values cause an explicit startup failure rather than a silent undefined.

# .env.example — committed to the repo, values are placeholders
STRIPE_SECRET_KEY=sk_test_xxxxxxxxxxxx
DATABASE_URL=postgresql://localhost:5432/myapp
OPENAI_API_KEY=sk-xxxxxxxxxxxxx

// src/env.ts — validated at startup; missing vars throw immediately
import { z } from 'zod'
export const env = z.object({
  STRIPE_SECRET_KEY: z.string().startsWith('sk_'),
  DATABASE_URL: z.string().url(),
  OPENAI_API_KEY: z.string().min(1),
}).parse(process.env)

Import from src/env.ts everywhere instead of reading process.env directly. This eliminates undocumented vars at the schema level and surfaces missing configuration at startup rather than mid-request.