The Phantom Env Var

A config cleanup changed how production auth settings are selected. Local tests still look fine, but CI now proves invalid auth can slip through.

Initial failing signalauth.test.js expects 401 but receives 200Expected behavior: Invalid authentication returns HTTP 401. · actual behavior: Invalid authentication returns HTTP 200.

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Trace how NODE_ENV selects auth config.
Compare the production and non-production decision paths.
Restore fail-closed production behavior without hardcoding secrets.

Focus Mode

Start

src/config.js

Likely area

src/config.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicConfig & Environment

DifficultyEasy

Est. time12 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace