updates on the otp updates on the customer app

main.go

@@ -84,6 +84,15 @@ func main() {
 	_ = godotenv.Load()
 	cfg := config.Load()
 
+	// Refuse to start on configuration that would be unsafe rather than merely
+	// wrong. JWT_SECRET_KEY used to default to a literal in config.go, which
+	// meant a clone of this repository was enough to mint a valid token for any
+	// account on any deployment that had not overridden it.
+	if err := cfg.Validate(); err != nil {
+		utils.Error("invalid configuration — refusing to start", "error", err)
+		os.Exit(1)
+	}
+
 	utils.Info("Starting Doormile Backend...")
 
 	// 2. Connect to Postgres, Redis & NATS