Admin auth for 15 FastAPI routes silently depended on Render's RENDER env var
Initial_Orange2985 · reddit · 2026-09-28
During a security pass on their FastAPI backend, the author found that admin checks guarding 15 sensitive routes (global purge, inference mode switching, observability) relied on os.environ.get("RENDER") — a variable Render injects itself, not one they set.
- Production on Render was fine, but the same Docker image on a VPS, Railway or Fly left all 15 routes wide open, with no error or log.
- The fix: use their existing ENVIRONMENT variable (defaults to production) and refuse unless explicitly non-production.
- After the fix, 10 tests went red — they had been testing the hole, not the protected routes. "However many tests break is basically how big the hole was."
- A codebase-wide search found two more instances: a JWT secret silently randomizing outside Render, and an ISHOSTED flag gating HSTS, error redaction, and per-user history isolation — all off anywhere that wasn't Render.
Rule kept: never make a security decision depend on a variable someone else sets; if missing, refuse rather than open.
More from coding & agent
- Walrus Memory makes agent context portable across LLMs — udmrzn · 2026-09-28
- Dev builds a fast photo viewer app with Astra, labels via Luna — banteg · 2026-09-28
- Yacine: three unrelated companies in two weeks all want custom AI-built business software — yacinelearning · 2026-09-28
- Dev flexes 12,000 agents run in just four weeks — airesearch12 · 2026-09-28
- Dev builds emoji picker with vector search over emoji descriptions — firasd · 2026-09-28
- Jev, a classification-only model from TypeSafe, scales a news workflow from 20 to 500+ items — every · 2026-09-28