Configuration management separates environment-specific values from code

Hardcoded environment-specific values — production database URLs, service endpoints, feature flag literals — mean configuration changes require code changes and redeployments, increasing the chance of accidental environment cross-contamination. CWE-15 (External Control of System or Configuration Setting) and OWASP A05 (Security Misconfiguration) both flag this pattern. NIST 800-53 CM-6 requires configuration management to separate configuration from code. A developer testing against a staging endpoint that is hardcoded in the file may accidentally push a commit that hits production services in a different environment.

Centralize all environment-specific values behind process.env and validate required variables at startup:

// lib/config.ts
const config = {
  apiUrl: process.env.NEXT_PUBLIC_API_URL ?? 'http://localhost:3001',
  dbUrl: process.env.DATABASE_URL,
  featureNewDashboard: process.env.FEATURE_NEW_DASHBOARD === 'true',
} as const

if (typeof window === 'undefined' && !config.dbUrl) {
  throw new Error('DATABASE_URL is required')
}

export default config

Remove any string literals that embed production hostnames, service URLs, or environment-specific feature toggles from source files. Use .env.example with placeholder values to document all required variables.