GPT-5 finding
Health check treats whitespace-only env vars as present
lowapi-contractmedium
- apps/web/app/api/health/route.ts:31-35
The intent (per comments) is to pre-emptively catch missing secrets so the next real request doesn’t fail. The check only flags undefined or empty-string values, but a whitespace-only value (e.g., " ") would be considered present and pass the health check, while still being effectively invalid for keys/secrets. This slightly undermines the stated goal of catching misconfiguration early.
Recommendation
Treat whitespace-only values as missing by trimming before checking, e.g., const v = process.env[name]; const isMissing = v == null || (typeof v === 'string' && v.trim() === ''); and use that in the filter.