Staging and test URLs are removed from codebase

A hardcoded http://localhost:3000/api shipped to production either fails outright (CORS blocked, connection refused) or — worse — routes real user traffic to a developer laptop if that port happens to tunnel out via ngrok. Staging URLs like api-staging.yourdomain.com bypass production rate limits, log into the wrong database, and can leak real user PII into non-production systems outside your audit scope.

Grep the codebase for localhost:, 127.0.0.1, and any staging./dev./preview. subdomain patterns outside test files. Replace each with a process.env.NEXT_PUBLIC_* read, and set the production value in your hosting platform's environment config. Double-check webhook URLs in Stripe, Supabase, and any third-party dashboards — those live outside the repo and are easy to miss.

// lib/config.ts
const API_URL = process.env.NEXT_PUBLIC_API_URL
if (!API_URL) throw new Error('NEXT_PUBLIC_API_URL is required')