E2E_TEST_MODE=true disables rate-limit and session enforcement. Guard in assertSecureRuntimeEnv() throws on load, but in packages/api/src/trpc.ts:141-144 the prod+E2E check only console.warns. A single removed import would silently re-enable bypass in production.
Evidence
packages/api/src/trpc.ts:141-144 — console.warn() instead of throw on prod+E2E_TEST_MODE
Defense-in-depth degraded. A future refactor that drops the assertSecureRuntimeEnv() import silently disables auth rate-limits in production.
Proposed Fix
In trpc.ts replace console.warn with throw new Error(...) or process.exit(1). Centralize all E2E-bypass checks in runtime-env.ts so they cannot be accidentally split.
Acceptance Criteria
Prod build with E2E_TEST_MODE=true refuses to start
Unit test validates fail-fast behavior
All E2E flags checked in single runtime-env.ts function
## Problem
`E2E_TEST_MODE=true` disables rate-limit and session enforcement. Guard in `assertSecureRuntimeEnv()` throws on load, but in `packages/api/src/trpc.ts:141-144` the prod+E2E check only `console.warn`s. A single removed import would silently re-enable bypass in production.
## Evidence
- `packages/api/src/trpc.ts:141-144 — console.warn() instead of throw on prod+E2E_TEST_MODE`
- `apps/web/src/server/auth.ts:50-56 — E2E_TEST_MODE bypasses rate-limit`
## Impact
Defense-in-depth degraded. A future refactor that drops the `assertSecureRuntimeEnv()` import silently disables auth rate-limits in production.
## Proposed Fix
In trpc.ts replace console.warn with `throw new Error(...)` or `process.exit(1)`. Centralize all E2E-bypass checks in `runtime-env.ts` so they cannot be accidentally split.
## Acceptance Criteria
- [ ] Prod build with E2E_TEST_MODE=true refuses to start
- [ ] Unit test validates fail-fast behavior
- [ ] All E2E flags checked in single `runtime-env.ts` function
---
Parent Epic: #1
Source: Full-Codebase Security Audit 2026-04-16 (A-6)
Resolved in commit 93a7fba (security: fail-fast dev-bypass flag in production). The auth bootstrap throws at startup if E2E_TEST_MODE=1 is set while NODE_ENV=production.
Resolved in commit 93a7fba (`security: fail-fast dev-bypass flag in production`). The auth bootstrap throws at startup if `E2E_TEST_MODE=1` is set while `NODE_ENV=production`.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
E2E_TEST_MODE=truedisables rate-limit and session enforcement. Guard inassertSecureRuntimeEnv()throws on load, but inpackages/api/src/trpc.ts:141-144the prod+E2E check onlyconsole.warns. A single removed import would silently re-enable bypass in production.Evidence
packages/api/src/trpc.ts:141-144 — console.warn() instead of throw on prod+E2E_TEST_MODEapps/web/src/server/auth.ts:50-56 — E2E_TEST_MODE bypasses rate-limitImpact
Defense-in-depth degraded. A future refactor that drops the
assertSecureRuntimeEnv()import silently disables auth rate-limits in production.Proposed Fix
In trpc.ts replace console.warn with
throw new Error(...)orprocess.exit(1). Centralize all E2E-bypass checks inruntime-env.tsso they cannot be accidentally split.Acceptance Criteria
runtime-env.tsfunctionParent Epic: #1
Source: Full-Codebase Security Audit 2026-04-16 (A-6)
Resolved in commit
93a7fba(security: fail-fast dev-bypass flag in production). The auth bootstrap throws at startup ifE2E_TEST_MODE=1is set whileNODE_ENV=production.