Skip to content

NEXT_PUBLIC_SITE_URL, read by sitemap.ts, is undocumented in both .env.example and README's environment variables table #256

Description

@chonilius

src/app/sitemap.ts reads a third environment variable that neither .env.example nor
README.md mentions:

const BASE_URL = process.env.NEXT_PUBLIC_SITE_URL ?? "https://mergefi.app";

.env.example documents exactly two variables (NEXT_PUBLIC_API_URL,
NEXT_PUBLIC_STELLAR_NETWORK), both described at length with comments explaining their
validation and defaults. README.md's "Environment variables" table lists the same two,
with a sentence noting "Both variables are validated at build time." NEXT_PUBLIC_SITE_URL
appears in neither place.

Unlike the other two variables, this one isn't validated by src/lib/env.ts at all — it's
read directly via process.env in sitemap.ts with a silent fallback to
"https://mergefi.app". Any deployment of this frontend to a domain other than
mergefi.app (a fork, a staging environment, a different production domain) that doesn't
happen to discover this undocumented variable will silently generate a sitemap whose
every URL points at https://mergefi.app/... instead of the actual deployed domain,
with no build-time warning of any kind — contrasting sharply with how deliberately loud
this app's other env-var misconfigurations are designed to be (per env.ts's own stated
philosophy of failing builds rather than silently defaulting for consequential values).

Suggested fix: add NEXT_PUBLIC_SITE_URL to both .env.example (with a comment
explaining it drives sitemap.ts's URLs) and the README's environment variables
table.

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programbugSomething isn't workingdocumentationImprovements or additions to documentationgood first issueGood for newcomershelp wantedExtra attention is needed

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions