Environment inventory

Generated: 2026-08-06T03:57:37.821Z

Statuses only — no secret values.

Variables referenced in code: 87

Variable	Scope	In .env.example	Live status
`AUTH_DEVICE_ID_PEPPER`	SERVER_SECRET	YES	EMPTY
`AUTH_LOCKOUT_SECONDS`	SERVER_CONFIG	YES	EMPTY
`AUTH_MAX_LOGIN_ATTEMPTS`	SERVER_CONFIG	YES	EMPTY
`AUTH_NEW_DEVICE_EMAIL_ENABLED`	SERVER_CONFIG	YES	EMPTY
`AUTH_NEW_DEVICE_NOTIFICATION_ENABLED`	SERVER_CONFIG	YES	EMPTY
`AUTH_REMEMBER_ME_TTL`	SERVER_CONFIG	YES	EMPTY
`AUTH_SESSION_ABSOLUTE_TTL_DAYS`	SERVER_CONFIG	YES	EMPTY
`ADMIN_BOOTSTRAP_ENABLED`	SERVER_CONFIG	NO	EMPTY
`ADMIN_EMAILS`	SERVER_CONFIG	YES	PRESENT
`ADMIN_PHONES`	SERVER_CONFIG	NO	PRESENT
`ALLOW_INTERNAL_WALLET_CREDIT`	SERVER_CONFIG	YES	PRESENT
`API_PUBLIC_URL`	SERVER_CONFIG	YES	PRESENT
`BODY_JSON_LIMIT`	SERVER_CONFIG	YES	PRESENT
`CORS_ORIGINS`	SERVER_CONFIG	YES	PRESENT
`DATABASE_URL`	SERVER_CONFIG	YES	PRESENT
`DB_HOST`	SERVER_CONFIG	YES	PRESENT
`DB_PORT`	SERVER_CONFIG	YES	PRESENT
`ESMS_BASE_URL`	SERVER_CONFIG	NO	MISSING
`ESMS_BRAND_NAME`	SERVER_CONFIG	NO	PRESENT
`ESMS_SMS_TYPE`	SERVER_CONFIG	NO	PRESENT
`EXPO_PUBLIC_API_DEBUG`	PUBLIC_CLIENT	NO	MISSING
`EXPO_PUBLIC_API_URL`	PUBLIC_CLIENT	YES	PRESENT
`EXPO_PUBLIC_ENV`	PUBLIC_CLIENT	YES	PRESENT
`EXPO_PUBLIC_GOOGLE_ANDROID_CLIENT_ID`	PUBLIC_CLIENT	YES	MISSING
`EXPO_PUBLIC_GOOGLE_CLIENT_ID`	PUBLIC_CLIENT	NO	MISSING
`EXPO_PUBLIC_GOOGLE_EXPO_CLIENT_ID`	PUBLIC_CLIENT	NO	MISSING
`EXPO_PUBLIC_GOOGLE_IOS_CLIENT_ID`	PUBLIC_CLIENT	YES	MISSING
`EXPO_PUBLIC_GOOGLE_MAPS_API_KEY`	PUBLIC_CLIENT	NO	MISSING
`EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID`	PUBLIC_CLIENT	YES	PLACEHOLDER
`EXPO_PUBLIC_MAPBOX_TOKEN`	PUBLIC_CLIENT	NO	MISSING
`EXPO_PUBLIC_WS_URL`	PUBLIC_CLIENT	YES	PRESENT
`FFMPEG`	SERVER_CONFIG	NO	MISSING
`HEALTH_DETAIL_ENABLED`	SERVER_CONFIG	YES	PRESENT
`HTTP_DEBUG`	SERVER_CONFIG	NO	PRESENT
`JWT_ACCESS_TTL`	SERVER_SECRET	YES	PRESENT
`JWT_REFRESH_TTL`	SERVER_SECRET	YES	PRESENT
`LOCALAPPDATA`	SERVER_CONFIG	NO	MISSING
`MAPBOX_ACCESS_TOKEN`	SERVER_SECRET	NO	PRESENT
`MOMO_ACCESS_KEY`	SERVER_SECRET	NO	PRESENT
`MOMO_ENDPOINT`	SERVER_CONFIG	NO	PRESENT
`MOMO_IPN_URL`	SERVER_CONFIG	NO	PRESENT
`MOMO_PARTNER_CODE`	SERVER_CONFIG	NO	PRESENT
`MOMO_REFUND_ENDPOINT`	SERVER_CONFIG	NO	MISSING
`MOMO_RETURN_URL`	SERVER_CONFIG	NO	PRESENT
`MOMO_SECRET_KEY`	SERVER_SECRET	NO	PRESENT
`NODE_ENV`	SERVER_CONFIG	YES	PRESENT
`NODE_TLS_REJECT_UNAUTHORIZED`	SERVER_CONFIG	NO	MISSING
`NOMINATIM_USER_AGENT`	SERVER_CONFIG	YES	PRESENT
`OPENAI_API_KEY`	SERVER_SECRET	NO	PRESENT
`OPENAI_BASE_URL`	SERVER_CONFIG	NO	MISSING
`OPENAI_MODEL`	SERVER_CONFIG	NO	MISSING
`OSRM_BASE_URL`	SERVER_CONFIG	YES	PRESENT
`OTP_CHANNEL`	SERVER_CONFIG	YES	PRESENT
`OTP_DEV_CODE`	SERVER_CONFIG	YES	PRESENT
`OTP_LOCK_SEC`	SERVER_CONFIG	YES	PRESENT
`OTP_MAX_ATTEMPTS`	SERVER_CONFIG	YES	PRESENT
`OTP_TTL_SEC`	SERVER_CONFIG	YES	PRESENT
`PAYMENTS_MOCK`	SERVER_CONFIG	YES	PRESENT
`PORT`	SERVER_CONFIG	YES	PRESENT
`POSTGIS_SCHEMA`	SERVER_CONFIG	YES	PRESENT
`REDIS_HOST`	SERVER_CONFIG	YES	PRESENT
`REDIS_PASSWORD`	SERVER_SECRET	YES	PRESENT
`REDIS_PORT`	SERVER_CONFIG	YES	PRESENT
`REDIS_URL`	SERVER_CONFIG	YES	PRESENT
`ROUTING_OSRM_ENABLED`	SERVER_CONFIG	YES	PRESENT
`ROUTING_PROVIDER`	SERVER_CONFIG	YES	PRESENT
`S3_BUCKET`	SERVER_CONFIG	YES	PRESENT
`S3_ENDPOINT`	SERVER_CONFIG	YES	PRESENT
`S3_FORCE_PATH_STYLE`	SERVER_CONFIG	YES	PRESENT
`S3_PRIVATE_BUCKET`	SERVER_SECRET	YES	PRESENT
`S3_PUBLIC_URL`	SERVER_CONFIG	YES	PRESENT
`S3_REGION`	SERVER_CONFIG	YES	PRESENT
`SMS_BRAND`	SERVER_CONFIG	NO	MISSING
`SMS_HTTP_API_KEY`	SERVER_SECRET	NO	MISSING
`SMS_PROVIDER`	SERVER_CONFIG	YES	PRESENT
`SMTP_FROM`	SERVER_CONFIG	YES	PRESENT
`SMTP_HOST`	SERVER_CONFIG	YES	PRESENT
`SMTP_PASS`	SERVER_CONFIG	NO	MISSING
`SMTP_PASSWORD`	SERVER_SECRET	NO	MISSING
`SMTP_PORT`	SERVER_CONFIG	YES	PRESENT
`SMTP_SECURE`	SERVER_CONFIG	YES	PRESENT
`SMTP_USER`	SERVER_CONFIG	NO	MISSING
`SWAGGER_ENABLED`	SERVER_CONFIG	YES	PRESENT
`TEMP`	SERVER_CONFIG	NO	MISSING
`TMP`	SERVER_CONFIG	NO	MISSING
`TRUST_PROXY`	SERVER_CONFIG	YES	PRESENT
`VITE_API_URL`	PUBLIC_CLIENT	YES	PRESENT
`VNPAY_HASH_SECRET`	SERVER_SECRET	NO	PRESENT
`VNPAY_REFUND_URL`	SERVER_CONFIG	NO	MISSING
`VNPAY_RETURN_URL`	SERVER_CONFIG	NO	PRESENT
`VNPAY_TMN_CODE`	SERVER_CONFIG	NO	PRESENT
`VNPAY_URL`	SERVER_CONFIG	NO	PRESENT
`WELIFE_VPS_HOST`	SERVER_CONFIG	NO	MISSING
`WELIFE_VPS_USER`	SERVER_CONFIG	NO	MISSING

Summary

EMPTY: 1
PRESENT: 61
MISSING: 24
PLACEHOLDER: 1

CRITICALSECRET_EXPOSURE (SERVER_SECRET with EXPO_PUBLIC): 0

Cross-app notes

Mobile Google Client ID live: see EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID row.
API GOOGLE_CLIENT_ID live: see row; PLACEHOLDER ⇒ OWNER_REQUIRED.
packages/shared not present — env parsers duplicated per app + scripts/env-check.mjs.