config-environments

Use canonical environment variable names like DATABASE_URL across all environments, letting each environment's config source supply the correct value instead of relying on suffixed names like DATABASE_URL_DEV or DATABASE_URL_PROD.

Runtime credential branching on NODE_ENV causes deployment errors because logic that picks *_DEV or *_PROD secrets can select wrong credentials or leak production-shaped state. Isolate credentials at provisioning time instead to prevent brittle deployments.

The best way to validate missing environment variables is to centralize environment reads at startup with fail-fast validation, treating missing or sensitive configuration as boot-time errors rather than sentinel-defaults that silently point at live systems.

Audit environment access patterns by reviewing env-var naming for suffixes, checking for NODE_ENV branching, evaluating build-time versus runtime bundling behavior, and identifying scattered env reads to ensure credentials are isolated per environment.

Do not use different environment variable names for each deployment environment. Use canonical variable names loaded by the config source everywhere, which prevents configuration mistakes and ensures each environment supplies its correct value.

Do not use sentinel default values for sensitive configuration variables. Treating missing configuration as boot-time errors prevents sentinel-defaults from silently pointing at live production systems and avoids credential leaks.