🔒 Fix hardcoded development secret in Auth configuration

[is0692vs]

🎯 What: Removed the hardcoded fallback_secret_for_development_only used for NEXTAUTH_SECRET when NODE_ENV === "development" in src/lib/auth.ts.
⚠️ Risk: Including hardcoded secrets in version control (even if supposedly intended for development) is a significant security risk. If deployed in an environment inadvertently flagged as "development" or if developers get used to relying on default secrets, the application's authentication tokens can be easily forged, leading to unauthorized access and session hijacking. It also violates the security principle of secure-by-default configurations.
🛡️ Solution: Removed the development environment check and fallback value. The application now uniformly enforces that NEXTAUTH_SECRET is securely provided via environment variables in all environments by throwing an explicit error when it is absent. The corresponding unit tests were also updated to verify this secure behavior.

---

PR created automatically by Jules for task 212169327899419093 started by @is0692vs

Greptile Summary

NEXTAUTH_SECRET の開発環境向け固定フォールバックを削除し、未設定時のエラー動作をテストで明示しています。

• すべての実行環境で NEXTAUTH_SECRET の設定を必須化
• 開発環境で未設定の場合に例外が発生することを検証

Confidence Score: 5/5

ブロッキングとなる問題は確認されず、このPRはマージして安全と考えられます。

ブロッキングとなる不具合は残っていません。

Important Files Changed

Filename	Overview
src/lib/auth.ts	開発環境用の固定シークレットを削除し、NEXTAUTH_SECRET 未設定時は一律に例外を送出する変更です。
src/lib/tests/auth.test.ts	開発環境でも NEXTAUTH_SECRET 未設定時に例外が発生するという新しい契約に合わせてテストを更新しています。

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into fix/remove-hard..." | Re-trigger Greptile}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
github-user-summary	Ignored		Aug 9, 2026 2:25pm

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• バグ修正
  • 開発環境でも NEXTAUTH_SECRET が未設定の場合にエラーを表示するよう変更しました。
  • 未設定の秘密鍵をフォールバック値で補うことなく、明示的な設定を必須にしました。

Walkthrough

NEXTAUTH_SECRET 未設定時の開発環境向けフォールバックを削除し、環境にかかわらず例外をスローする挙動へ変更しました。対応するテストも、例外発生を検証する内容に更新されています。

Changes

秘密鍵検証

Layer / File(s)	Summary
未設定秘密鍵のエラー化 src/lib/auth.ts, src/lib/__tests__/auth.test.ts	getSecret() は NEXTAUTH_SECRET 未設定時に常に例外をスローし、開発環境のテストはこのエラーを検証するよう更新された。

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• Hiroki-org/github-user-summary#401: getSecret() の未設定時におけるフォールバックと例外処理を扱う、同じコード経路の変更。

Poem

ぴょんと跳ねたら秘密鍵、
ないならエラーで知らせるよ。
開発の森にも油断なし、
テストが足あと見つけたね。
にんじん片手に、安心ぴょん！

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	タイトルは、開発環境用の固定シークレットを削除する主要な変更を明確かつ簡潔に示しています。
Description check	✅ Passed	説明は、固定シークレットの削除、環境変数の必須化、およびテスト更新を変更内容に関連付けて説明しています。

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/remove-hardcoded-dev-secret-212169327899419093

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 93.75000% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/components/BusinessCard.tsx	93.75%	0 Missing and 3 partials ⚠️

📢 Thoughts on this report? Let us know!

[is0692vs]

@greptile review

[is0692vs]

最新main取り込み後、自動コミットが古いスナップショットを再適用し、セキュリティ修正と無関係なBusinessCard実装・テストを巻き戻しました。このブランチは安全に収束しないため閉じ、削除します。