affaan-m/ECC · error

OPENAI_API_KEY not configured

Error message

OPENAI_API_KEY not configured

What it means

Illustrative snippet from the security-review skill: after reading process.env.OPENAI_API_KEY, the code throws this sentinel when the variable is absent. It marks a missing-configuration error at startup — no secret was configured, so dependent API calls cannot be made.

Source

Thrown at skills/security-review/SKILL.md:39

## Security Checklist

### 1. Secrets Management

#### FAIL: NEVER Do This
```typescript
const apiKey = "sk-proj-xxxxx"  // Hardcoded secret
const dbPassword = "password123" // In source code
```

#### PASS: ALWAYS Do This
```typescript
const apiKey = process.env.OPENAI_API_KEY
const dbUrl = process.env.DATABASE_URL

// Verify secrets exist
if (!apiKey) {
  throw new Error('OPENAI_API_KEY not configured')
}
```

#### Verification Steps
- [ ] No hardcoded API keys, tokens, or passwords
- [ ] All secrets in environment variables
- [ ] `.env.local` in .gitignore
- [ ] No secrets in git history
- [ ] Production secrets in hosting platform (Vercel, Railway)

### 2. Input Validation

#### Always Validate User Input
```typescript
import { z } from 'zod'

// Define validation schema
const CreateUserSchema = z.object({

View on GitHub (pinned to d8409a4b08)

Solutions

1. Set the variable in the environment or hosting platform's secret manager
2. Fail fast at startup with a list of all missing required secrets
3. Add the key to .env.local locally and keep it out of git

When it happens

Trigger: Thrown at skills/security-review/SKILL.md:39 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of affaan-m/ECC@d8409a4b08 (2026-08-26). Data as JSON: /api/errors/69ae17172a6f2fbe. Report an issue: GitHub.