bug: hardcoded fallback secret in REVALIDATE_WEBHOOK_SECRET

[nanaf6203-bit]

Summary

src/app/api/revalidate/route.ts defines WEBHOOK_SECRET as a fallback string literal that ships with the source code.

Affected area

• src/app/api/revalidate/route.ts line 7: const WEBHOOK_SECRET = process.env.REVALIDATE_WEBHOOK_SECRET || 'your-webhook-secret';

Steps to reproduce / impact

If the env var is misconfigured or absent in production, the route will silently accept all requests signed with the literal default string. This renders the HMAC verification useless and opens the revalidation endpoint to spoofing.

Expected behaviour

Throw at startup if REVALIDATE_WEBHOOK_SECRET is missing in production. Provide a clear error message to developers running locally.

Acceptance criteria

• Remove the default fallback secret.
• Throw a descriptive error on missing secret.
• Document required env vars in .env.example and README.md.
• Add a test confirming the route rejects requests when the secret is missing.

[Akinyemi04]

@Akinyemi04 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Akinyemi04 to this issue.

[tobiadewola41-eng]

@tobiadewola41-eng has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Can I work on this please

ℹ️ Repo Maintainers: To accept this application, review their application or assign @tobiadewola41-eng to this issue.

[laraba9987-cmyk]

@laraba9987-cmyk has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

i would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @laraba9987-cmyk to this issue.

[OmniZlatoon]

@OmniZlatoon has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

GOOD MORNING, I have 5 years of experience working on tasks like this and handling similar challenges across backend, frontend, and smart-contract development. I have carefully read and fully understood the task requirements, and I am confident I can deliver a clean, efficient, and well-tested solution promptly. I always ensure high-quality implementation, maintainability, and adherence to best practices.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @OmniZlatoon to this issue.

[drips-wave]

Congratulations, @laraba9987-cmyk! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @laraba9987-cmyk: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @laraba9987-cmyk as part of the Stellar Wave Program's 6th Wave 🥳

😎 @laraba9987-cmyk: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.