src/app/sitemap.ts reads a third environment variable that neither .env.example nor
README.md mentions:
const BASE_URL = process.env.NEXT_PUBLIC_SITE_URL ?? "https://mergefi.app";
.env.example documents exactly two variables (NEXT_PUBLIC_API_URL,
NEXT_PUBLIC_STELLAR_NETWORK), both described at length with comments explaining their
validation and defaults. README.md's "Environment variables" table lists the same two,
with a sentence noting "Both variables are validated at build time." NEXT_PUBLIC_SITE_URL
appears in neither place.
Unlike the other two variables, this one isn't validated by src/lib/env.ts at all — it's
read directly via process.env in sitemap.ts with a silent fallback to
"https://mergefi.app". Any deployment of this frontend to a domain other than
mergefi.app (a fork, a staging environment, a different production domain) that doesn't
happen to discover this undocumented variable will silently generate a sitemap whose
every URL points at https://mergefi.app/... instead of the actual deployed domain,
with no build-time warning of any kind — contrasting sharply with how deliberately loud
this app's other env-var misconfigurations are designed to be (per env.ts's own stated
philosophy of failing builds rather than silently defaulting for consequential values).
Suggested fix: add NEXT_PUBLIC_SITE_URL to both .env.example (with a comment
explaining it drives sitemap.ts's URLs) and the README's environment variables
table.
src/app/sitemap.tsreads a third environment variable that neither.env.examplenorREADME.mdmentions:.env.exampledocuments exactly two variables (NEXT_PUBLIC_API_URL,NEXT_PUBLIC_STELLAR_NETWORK), both described at length with comments explaining theirvalidation and defaults.
README.md's "Environment variables" table lists the same two,with a sentence noting "Both variables are validated at build time."
NEXT_PUBLIC_SITE_URLappears in neither place.
Unlike the other two variables, this one isn't validated by
src/lib/env.tsat all — it'sread directly via
process.envinsitemap.tswith a silent fallback to"https://mergefi.app". Any deployment of this frontend to a domain other thanmergefi.app(a fork, a staging environment, a different production domain) that doesn'thappen to discover this undocumented variable will silently generate a sitemap whose
every URL points at
https://mergefi.app/...instead of the actual deployed domain,with no build-time warning of any kind — contrasting sharply with how deliberately loud
this app's other env-var misconfigurations are designed to be (per
env.ts's own statedphilosophy of failing builds rather than silently defaulting for consequential values).
Suggested fix: add
NEXT_PUBLIC_SITE_URLto both.env.example(with a commentexplaining it drives
sitemap.ts's URLs) and the README's environment variablestable.