Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .env.example
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,8 @@ ENCRYPTION_SALT="MyFixedSalt"

# Ports
PORT_BUN_SERVER=3000
PORT_WEB_SERVER=8080
PORT_WEB_SERVER=8080
MCP_PORT=3001

# API
API_BASE_URL="http://localhost:3000"
1 change: 1 addition & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ COPY --from=prerelease /usr/src/app/package.json .
COPY --from=prerelease /usr/src/app/prisma.config.ts .
COPY --from=prerelease /usr/src/app/src ./src
COPY --from=prerelease /usr/src/app/prisma ./prisma
COPY --from=prerelease /usr/src/app/.env.example ./.env
Copy link

Copilot AI Dec 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copying .env.example to .env in the Docker container is problematic. The .env.example file is meant to be a template showing which environment variables need to be set, not actual configuration values to be used in production. Docker containers should receive environment variables through proper mechanisms like docker-compose environment variables, Kubernetes secrets, or runtime environment injection. This approach could lead to using example/placeholder values in production deployments.

Suggested change
COPY --from=prerelease /usr/src/app/.env.example ./.env

Copilot uses AI. Check for mistakes.

# run the app
USER bun
Expand Down
3 changes: 2 additions & 1 deletion prisma/db.ts
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@ import { PrismaPg } from "@prisma/adapter-pg";
import { Pool } from "pg";
import { PrismaClient } from "./generated/client";

const connectionString = process.env.DATABASE_URL;
const connectionString =
process.env.DATABASE_URL || "postgresql://root:root@localhost:5432/myhouse";

Comment on lines +5 to 7
Copy link

Copilot AI Dec 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hardcoding database credentials (username: "root", password: "root") as a fallback creates a security risk. If DATABASE_URL is accidentally unset in production, the application would attempt to connect using these insecure default credentials. Instead, consider failing fast with a clear error message when DATABASE_URL is missing, or only use this default in development environments with an explicit check (e.g., checking NODE_ENV).

Suggested change
const connectionString =
process.env.DATABASE_URL || "postgresql://root:root@localhost:5432/myhouse";
let connectionString: string;
if (process.env.DATABASE_URL) {
connectionString = process.env.DATABASE_URL;
} else if (
process.env.NODE_ENV === "development" ||
process.env.NODE_ENV === "test"
) {
// Development/test fallback connection string
connectionString = "postgresql://root:root@localhost:5432/myhouse";
} else {
throw new Error(
"DATABASE_URL environment variable is not set. Please configure it before starting the application.",
);
}

Copilot uses AI. Check for mistakes.
// biome-ignore lint/suspicious/noExplicitAny: Dynamic prisma type for test/prod
type PrismaType = PrismaClient | any;
Expand Down