fix(security): fail fast on known default secrets outside development (issue #130)

Author: Senthil455

docker-compose.yml

@@ -146,6 +146,7 @@ services:
       - "8080:8080"
     environment:
       - JWT_SECRET=${JWT_SECRET:-change-me-to-a-long-random-string}
+      - NODE_ENV=${NODE_ENV:-development}
       - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-http://localhost:3000}
       - AUTH_SERVICE_URL=http://auth-service:8010
       - EMPLOYEE_SERVICE_URL=http://employee-service:8001

services/api-gateway-node/index.js

@@ -126,6 +126,11 @@ if (!JWT_SECRET) {
   process.exit(1);
 }
 
+if (NODE_ENV !== 'development' && (INTERNAL_JWT_SECRET === 'atlas-internal-jwt-secret-change-me' || JWT_SECRET === 'change-me-to-a-long-random-string')) {
+  console.error('FATAL: refusing to start outside development with known default secrets (INTERNAL_JWT_SECRET / JWT_SECRET); set strong values via .env');
+  process.exit(1);
+}
+
 const jwtSecret = JWT_SECRET;
 
 const allowedOrigins = (process.env.ALLOWED_ORIGINS || 'http://localhost:3000')

services/auth-service/index.js

@@ -119,6 +119,11 @@ if (!SCIM_API_KEY) {
   process.exit(1);
 }
 
+if (NODE_ENV !== 'development' && (JWT_SECRET === 'change-me-to-a-long-random-string' || ADMIN_DEFAULT_PASSWORD === 'ChangeMe123!')) {
+  console.error('FATAL: refusing to start outside development with known default secrets (JWT_SECRET / ADMIN_DEFAULT_PASSWORD); set strong values via .env');
+  process.exit(1);
+}
+
 const jwtSecret = JWT_SECRET;
 
 if (!process.env.POSTGRES_URL) {