From c92181b90fdc6db201e6582258c4ad46def60e11 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yusuf=20=C4=B0pek?= <yusufipek@protonmail.com>
Date: Fri, 10 Apr 2026 21:13:43 +0300
Subject: [PATCH] feat(rate-limit): enforce rate limit configuration in
 production environment

---
 lib/rate-limit.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/rate-limit.ts b/lib/rate-limit.ts
index d54bbe1..2c06f55 100644
--- a/lib/rate-limit.ts
+++ b/lib/rate-limit.ts
@@ -26,6 +26,13 @@ function isRateLimitDisabled(): boolean {
     return rawValue !== undefined && TRUTHY_ENV_VALUES.has(rawValue);
 }
 
+if (process.env.NODE_ENV === 'production' && isRateLimitDisabled()) {
+    throw new Error(
+        'DISABLE_RATE_LIMIT must not be set in production. ' +
+        'Remove or unset the environment variable before deploying.'
+    );
+}
+
 // Industry-standard rate limit defaults per action
 export const RATE_LIMIT_CONFIGS: Record<string, RateLimitConfig> = {
     // Auth — strict to prevent brute force / credential stuffing