[Codeinx]

Problem

src/config/env.ts declared:

CORS_ORIGIN: z.string().default("http://localhost:3000"),

Two problems: it's a single string, so the API can't serve a preview deployment and production at once; and the default is a development origin that silently applies in production if the variable is unset — a misconfiguration that fails open rather than closed.

What this does

• CORS_ORIGIN is now comma-separated, parsed into an array (parseCorsOrigins) — multiple origins are supported at once.
• No default in the schema. A superRefine on the env schema requires CORS_ORIGIN to be set explicitly whenever NODE_ENV === "production", and rejects "*" in production (alone or mixed into a list) — either failure throws at startup via parseEnv, not at the first request.
• Outside production, an unset CORS_ORIGIN still falls back to the dev default (resolveCorsOrigins), so local development is unaffected.
• @fastify/cors is now registered with credentials: true and an explicit methods list instead of leaving both implicit.

Testing

src/config/env.test.ts adds cases for: comma-separated parsing, the dev fallback, production rejecting a missing CORS_ORIGIN, production rejecting "*" (alone and mixed into a list), and production accepting a valid explicit origin.

npm run lint, npm run build, npm test, and npm audit --audit-level=high are all clean on this branch.

Scope note

Touches only src/config/env.ts, src/config/env.test.ts, and src/index.ts (the cors registration call). No other currently-open PR touches these files, so this should apply independently of merge order.

Closes #2.

[joelpeace48-cell]

Nice job @Codeinx