Environment variables are production values
Why it matters
Shipping a production app with test or sandbox credentials is among the most common vibe-coded project failures: Stripe charges go nowhere (pk_test_ keys process no real money), transactional emails vanish into sandbox inboxes, and OAuth flows silently reject real user tokens. CWE-798 and OWASP A05 both flag hardcoded or misconfigured credentials as a critical vulnerability class. Beyond service failures, a localhost DATABASE_URL in production means every API call hits a dead connection — the app appears live but is entirely non-functional.
Severity rationale
Critical because test credentials silently disable payment processing, email delivery, and third-party authentication in production — users take real actions that produce no real outcome.
Remediation
Audit every service integration before going live. Check the hosting platform's environment variable configuration, not just your local .env.local.
# List all environment variables configured for production (Vercel)
vercel env ls production
Confirm: Stripe uses pk_live_/sk_live_ keys, not pk_test_. Email providers use production SMTP or API credentials. NEXTAUTH_URL or NEXT_PUBLIC_APP_URL points to your real domain, not localhost. OAuth app client IDs belong to a production app with your real domain in the authorized redirect URIs. After switching to production credentials, trigger a test payment, user registration, and transactional email to verify end-to-end.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Pre-Launch Checklist Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-798 — Use of Hard-coded Credentials
- owasp:2021 · A05 — Security Misconfiguration
- nist:rev5 · IA-5 — Authenticator Management
Taxons
History
- 2026-04-18·v1.0.0·Initial import from pre-launch·automated