App validates required env vars at startup

An application that silently starts without a required environment variable will either crash at the specific moment the missing config is first used — mid-request, during a payment, or at checkout — or it will fall back to an undefined value and behave incorrectly without any error. OWASP A05 (Security Misconfiguration) covers misconfigured applications that fail silently. CWE-390 (Detection of Error Condition Without Action) applies when missing configuration is neither detected nor surfaced. Startup validation converts a runtime surprise into a deployment-time failure, where it is cheap to catch and easy to diagnose.

Add a validation module that imports before any application logic and throws a descriptive error listing every missing variable. Import it as the first line of your server entry point.

// src/config.ts
const required = [
  'DATABASE_URL',
  'STRIPE_SECRET_KEY',
  'JWT_SECRET',
  'NEXTAUTH_SECRET',
] as const

for (const key of required) {
  if (!process.env[key]) {
    throw new Error(`Missing required environment variable: ${key}`)
  }
}

export const config = {
  databaseUrl: process.env.DATABASE_URL!,
  stripeSecretKey: process.env.STRIPE_SECRET_KEY!,
  jwtSecret: process.env.JWT_SECRET!,
} satisfies Record<string, string>

// src/server.ts — first import
import './config'  // validation runs immediately on module load

For Next.js, place this in src/lib/env.ts and import from both next.config.ts and any server-side entry point.