Performed code audit before launch

.env.example

@@ -2,11 +2,15 @@
 DATABASE_URL="postgresql://postgres:postgres@127.0.0.1:54322/postgres"
 
 # GitHub App Integration
+# For local dev, you can often use a raw PEM string for the private key.
+# For server environments (Vercel, Docker), provide the key as a Base64-encoded string - see README for details.
+# The app will handle decoding automatically.
 NEXT_PUBLIC_GITHUB_APP_ID="123456"
 GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\nYOUR_PRIVATE_KEY_HERE\n-----END RSA PRIVATE KEY-----"
 GITHUB_APP_WEBHOOK_SECRET="your-github-app-webhook-secret-here"
 GITHUB_APP_CLIENT_ID="Iv1.your-client-id-here"
 GITHUB_APP_CLIENT_SECRET="your-client-secret-here"
+GITHUB_APP_CALLBACK_URL="http://localhost:3000/api/auth/callback/github"
 NEXT_PUBLIC_GITHUB_APP_NAME="jules-task-queue"
 
 # Cron job verification token (for Firebase you also need to add this in ./functions/.env as well)

package.json

@@ -20,7 +20,8 @@
     "db:studio": "prisma studio",
     "type-check": "tsc --noEmit",
     "cron:run": "curl -X POST http://localhost:3000/api/cron/retry --header 'Authorization: Bearer $CRON_SECRET'",
-    "ngrok": "ngrok http 3000"
+    "ngrok": "ngrok http 3000",
+    "tree": "tree -f -I \".next|node_modules|migrations\" -L 3a"
   },
   "dependencies": {
     "@icons-pack/react-simple-icons": "^13.3.0",

src/app/api/auth/authorize/github/route.ts

@@ -29,6 +29,14 @@ function isValidRedirectUrl(redirectTo: string): boolean {
 }
 
 export async function GET(request: NextRequest) {
+  // Validate required env at runtime
+  if (!env.GITHUB_APP_CALLBACK_URL) {
+    logger.error("Missing GITHUB_APP_CALLBACK_URL env variable");
+    return NextResponse.json(
+      { error: "Server misconfiguration: missing callback URL" },
+      { status: 500 },
+    );
+  }
   const { searchParams } = new URL(request.url);
   const installationId = searchParams.get("installation_id");
   const redirectTo = searchParams.get("redirect_to") || "/github-app/success";