fix: configuration file uses environment variables w... in config.js

[anupamme]

Summary

Fix critical severity security issue in config.js.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	config.js:1
Assessment	Likely exploitable
Chain Complexity	2-step

Description: Configuration file uses environment variables with empty string defaults, allowing credentials to be hardcoded or left unset. While the code attempts to use environment variables, the fallback to empty strings means that if environment variables are not set, the application will operate with no credentials or with defaults that could be committed to version control. The token and userId are sensitive credentials that provide direct access to external APIs.

Evidence

Exploitation scenario: An attacker who gains access to the source code repository or deployed application files can extract the configuration values.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• config.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project builds successfully with this change applied.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security