From 1860adbbab3781067c7d449e3981462d91091500 Mon Sep 17 00:00:00 2001
From: "rhea-security[bot]"
 <301977876+rhea-security[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:24:27 +0000
Subject: [PATCH] fix(authentication): auth secret validated with insufficient
 minimum strength

---
 lib/auth.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/auth.ts b/lib/auth.ts
index c7030dc..fd920e4 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -9,7 +9,10 @@ import { getEnabledSocialProvidersConfig } from "./auth-providers";
 import { applyOrderPaidEntitlement } from "./billing";
 
 const authEnvSchema = z.object({
-  BETTER_AUTH_SECRET: z.string().trim().min(1),
+  BETTER_AUTH_SECRET: z
+    .string()
+    .trim()
+    .min(32, "BETTER_AUTH_SECRET must be at least 32 characters"),
   BETTER_AUTH_URL: z.string().url(),
   // Polar is optional — the app runs fine without payments configured.
   POLAR_ACCESS_TOKEN: z.string().trim().min(1).optional(),