From 3d1d2bf76676274fc37476ff03db50f98560f783 Mon Sep 17 00:00:00 2001
From: Rakshak05 <159248180+Rakshak05@users.noreply.github.com>
Date: Mon, 10 Aug 2026 19:24:51 +0530
Subject: [PATCH] Resolves issue-#7718

---
 lib/validate-env.test.ts | 24 ++++++++++++++++++++++++
 lib/validate-env.ts      | 12 ++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/lib/validate-env.test.ts b/lib/validate-env.test.ts
index 55c90227c..02ed488a7 100644
--- a/lib/validate-env.test.ts
+++ b/lib/validate-env.test.ts
@@ -69,6 +69,24 @@ describe('validateCriticalEnv — AUTH_SECRET errors', () => {
     expect(result.valid).toBe(false);
     expect(result.errors[0]).toMatch(/31 chars/);
   });
+
+  it('returns an error when AUTH_SECRET is set to fallback-secret', () => {
+    const result = validateCriticalEnv(validEnv({ AUTH_SECRET: 'fallback-secret' }));
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toMatch(
+      /AUTH_SECRET environment variable must be set to a secure value/
+    );
+  });
+
+  it('returns an error when AUTH_SECRET contains fallback-secret', () => {
+    const result = validateCriticalEnv(
+      validEnv({ AUTH_SECRET: 'this-is-a-long-fallback-secret-string-32chars!' })
+    );
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toMatch(
+      /AUTH_SECRET environment variable must be set to a secure value/
+    );
+  });
 });
 
 describe('validateCriticalEnv — ENCRYPTION_KEY errors', () => {
@@ -144,6 +162,12 @@ describe('assertCriticalEnv — throws on bad config', () => {
     expect(() => assertCriticalEnv(validEnv({ AUTH_SECRET: undefined }))).toThrow(/AUTH_SECRET/);
   });
 
+  it('throws when AUTH_SECRET is set to fallback-secret', () => {
+    expect(() => assertCriticalEnv(validEnv({ AUTH_SECRET: 'fallback-secret' }))).toThrow(
+      /AUTH_SECRET environment variable must be set to a secure value/
+    );
+  });
+
   it('throws when ENCRYPTION_KEY is missing', () => {
     expect(() => assertCriticalEnv(validEnv({ ENCRYPTION_KEY: undefined }))).toThrow(
       /ENCRYPTION_KEY/
diff --git a/lib/validate-env.ts b/lib/validate-env.ts
index fcedecedf..822ccd0be 100644
--- a/lib/validate-env.ts
+++ b/lib/validate-env.ts
@@ -33,6 +33,12 @@ export function validateCriticalEnv(env: NodeJS.ProcessEnv = process.env): EnvVa
         'Generate one with: openssl rand -base64 32 ' +
         'and add it to your .env.local and deployment environment.'
     );
+  } else if (
+    authSecret === 'fallback-secret' ||
+    authSecret.toLowerCase().includes('fallback-secret') ||
+    ['secret', 'changeme', 'change-me', 'default-secret'].includes(authSecret.toLowerCase())
+  ) {
+    errors.push('AUTH_SECRET environment variable must be set to a secure value');
   } else if (authSecret.length < 32) {
     errors.push(
       `AUTH_SECRET is too short (${authSecret.length} chars). ` +
@@ -50,6 +56,12 @@ export function validateCriticalEnv(env: NodeJS.ProcessEnv = process.env): EnvVa
         'Generate one with: openssl rand -hex 32 ' +
         'and add it to your .env.local and deployment environment.'
     );
+  } else if (
+    encryptionKey === 'fallback-secret' ||
+    encryptionKey.toLowerCase().includes('fallback-secret') ||
+    ['secret', 'changeme', 'change-me', 'default-secret'].includes(encryptionKey.toLowerCase())
+  ) {
+    errors.push('ENCRYPTION_KEY environment variable must be set to a secure value');
   } else if (encryptionKey.length < 32) {
     errors.push(
       `ENCRYPTION_KEY is too short (${encryptionKey.length} chars). ` +