Deploy: 2026-05-21 01:58:32

backend/app/Core/Security.php

@@ -14,7 +14,10 @@ class Security
      */
     private static function getEncryptionKey(): string
     {
-        $key = getenv('ENCRYPTION_KEY') ;
+        $key = getenv('ENCRYPTION_KEY');
+        if (!$key || strlen($key) < 16) {
+            throw new \RuntimeException("ENCRYPTION_KEY environment variable is empty or too short. Cryptographic operations aborted.");
+        }
         return substr(hash('sha256', $key, true), 0, 32);
     }
 
@@ -23,7 +26,11 @@ class Security
      */
     private static function getHmacSalt(): string
     {
-        return getenv('HMAC_SALT');
+        $salt = getenv('HMAC_SALT');
+        if (!$salt) {
+            throw new \RuntimeException("HMAC_SALT environment variable is empty. Cryptographic operations aborted.");
+        }
+        return $salt;
     }
 
     /**
@@ -31,7 +38,11 @@ class Security
      */
     private static function getJwtSecret(): string
     {
-        return getenv('JWT_SECRET');
+        $secret = getenv('JWT_SECRET');
+        if (!$secret) {
+            throw new \RuntimeException("JWT_SECRET environment variable is empty. Cryptographic operations aborted.");
+        }
+        return $secret;
     }
 
     /**