Encryption keys are read from env, not hardcoded

A hardcoded AES key like 'this-is-a-32-character-secret!!' passed to crypto.createCipheriv() is committed to source control and therefore permanently exposed to every developer who has ever had repo access, every CI system, every build log, and every git history tool. CWE-321 (Use of Hard-coded Cryptographic Key) and OWASP A02 (Cryptographic Failures) describe the consequence: if the key is compromised — and it is, the moment it was committed — every record encrypted with that key is decryptable by anyone with the history.

Read the key from an environment variable and validate it at startup with a Zod schema to fail fast if it's missing or malformed.

// Bad: key is a string literal in source
const cipher = crypto.createCipheriv('aes-256-cbc', 'this-is-a-32-character-secret!!', iv)

// Good: key from env, validated at startup
import { z } from 'zod'
const Env = z.object({ ENCRYPTION_KEY: z.string().length(64) })  // 32 bytes = 64 hex chars
const env = Env.parse(process.env)
const key = Buffer.from(env.ENCRYPTION_KEY, 'hex')
const cipher = crypto.createCipheriv('aes-256-cbc', key, iv)

Generate a secure key with node -e "console.log(require('crypto').randomBytes(32).toString('hex'))" and store it in .env.local (never commit it). Rotate the key and re-encrypt all records if it was previously hardcoded.