From 2697e320be7398c34337a7e3804c523e1e0633de Mon Sep 17 00:00:00 2001
From: Claude Agent <noreply@anthropic.com>
Date: Tue, 1 Sep 2026 13:11:19 +0000
Subject: [PATCH] feat(security): warn at startup when PUBLIC_HOST/DB
 connection env vars are missing

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 src/server.ts | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/server.ts b/src/server.ts
index 92739ad..455dbb1 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -14,6 +14,19 @@ if (!process.env.SMB_ADDRESS) {
   Log().warn('SMB_ADDRESS environment variable not set, using defaults');
 }
 
+if (!process.env.PUBLIC_HOST) {
+  Log().warn('PUBLIC_HOST is not set — falling back to localhost default');
+}
+
+if (
+  !process.env.DB_CONNECTION_STRING &&
+  !process.env.MONGODB_CONNECTION_STRING
+) {
+  Log().warn(
+    'DB_CONNECTION_STRING is not set — using localhost MongoDB default'
+  );
+}
+
 const ENDPOINT_IDLE_TIMEOUT_S: string =
   process.env.ENDPOINT_IDLE_TIMEOUT_S ?? '60';