05/09 Update: security enhanced

app/config.py

@@ -4,6 +4,9 @@ from dotenv import load_dotenv
 
 load_dotenv()
 
+# Shared set of known-insecure placeholder values that must never reach production.
+_INSECURE_SECRET_DEFAULTS = {'dev-secret-change-me', 'jwt-secret-change-me', '', 'change-me'}
+
 
 class BaseConfig:
     SECRET_KEY = os.environ.get('SECRET_KEY', 'dev-secret-change-me')
@@ -79,6 +82,38 @@ class ProductionConfig(BaseConfig):
     SESSION_COOKIE_HTTPONLY = True
     SESSION_COOKIE_SAMESITE = 'Lax'
 
+    # ── Critical security checks — fail loudly at startup, not silently at runtime ──
+    # These checks run at class definition time (i.e. at import / app startup).
+    # Any misconfiguration raises RuntimeError immediately so the process never
+    # serves a single request with an insecure configuration.
+
+    _secret_key = os.environ.get('SECRET_KEY', '')
+    if not _secret_key or _secret_key in _INSECURE_SECRET_DEFAULTS:
+        raise RuntimeError(
+            '[PassKeeper] SECRET_KEY is not set or uses an insecure placeholder. '
+            'Generate a strong key with: python -c "import secrets; print(secrets.token_hex(32))" '
+            'and add SECRET_KEY=<value> to your production .env file.'
+        )
+    SECRET_KEY = _secret_key
+
+    _jwt_secret = os.environ.get('JWT_SECRET_KEY', '')
+    if not _jwt_secret or _jwt_secret in _INSECURE_SECRET_DEFAULTS:
+        raise RuntimeError(
+            '[PassKeeper] JWT_SECRET_KEY is not set or uses an insecure placeholder. '
+            'Generate a strong key with: python -c "import secrets; print(secrets.token_hex(32))" '
+            'and add JWT_SECRET_KEY=<value> to your production .env file.'
+        )
+    JWT_SECRET_KEY = _jwt_secret
+
+    _cors = os.environ.get('CORS_ORIGINS', '')
+    if not _cors or _cors.strip() == '*':
+        raise RuntimeError(
+            '[PassKeeper] CORS_ORIGINS must be set to a specific origin in production '
+            '(e.g. CORS_ORIGINS=https://pwkeeper.ngodanguyen.tech). '
+            'A wildcard "*" is not permitted in production.'
+        )
+    CORS_ORIGINS = _cors
+
 
 config = {
     'development': DevelopmentConfig,