feat(config): support Docker Compose _FILE secrets for env vars

[themavik]

Adds resolveDockerSecrets() to read _FILE environment variables, enabling Docker Compose secrets support for sensitive configuration.

[maidul98]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[greptile-apps]

Greptile Summary

Added resolveDockerSecrets() function to automatically read Docker Compose/Swarm secrets from *_FILE environment variables.

Key Changes:

• Imported fs module at line 1
• Added resolveDockerSecrets() function (lines 23-34) that iterates through all env vars, finds those ending in _FILE, and reads the file contents into the base variable name
• Function executes immediately on module load (line 35)
• Removed various code comments throughout the schema definition (cleanup changes)

Critical Security Issue:
The implementation has a path traversal vulnerability that allows reading arbitrary files from the filesystem. Any user who can control environment variables (through container configs, CI/CD, or deployment manifests) can read any file the process has access to, including system files, application secrets, and sensitive data.

Additional Issues:

• No file size limits - could cause memory DoS by reading large files
• Silent error handling hides security-relevant failures
• Missing documentation - users won't know this feature exists

Confidence Score: 1/5

• This PR introduces a critical path traversal vulnerability that must be fixed before merging
• Score of 1 reflects the critical security vulnerability allowing arbitrary file reads. While the feature itself is useful for Docker secrets, the implementation lacks basic security controls (path validation, file size limits) that could be exploited by attackers with environment variable control
• backend/src/lib/config/env.ts requires immediate security fixes for path traversal and DoS vulnerabilities

Important Files Changed

Filename	Overview
backend/src/lib/config/env.ts	Adds Docker secrets support via _FILE suffix resolution. Found critical path traversal vulnerability allowing arbitrary file reads.

_{Last reviewed commit: 8ae642e}

[greptile-apps]

_{1 file reviewed, 4 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Critical Path Traversal Vulnerability

Bad actors can use any *_FILE env var to read arbitrary files from the filesystem using path traversal patterns. An attacker with control over environment variables (e.g., through container orchestration misconfigurations, CI/CD injection, or compromised deployment configs) could:

1. Exfiltrate sensitive files by setting them as config values that get logged or transmitted
2. Read application secrets from other locations on the filesystem
3. Access system files like private keys or database configs

Required Fix: Restrict file paths to allowed directories (e.g., /run/secrets/, /var/run/secrets/). Use path.resolve() to get absolute paths and verify they start with an allowed directory prefix before reading.

[greptile-apps]

Missing file size limit allows reading extremely large files into memory, potentially causing DoS. Add max file size check (e.g., 1MB limit) before readFileSync.

[greptile-apps]

Silent error handling hides critical issues. If an attacker provides an invalid path, you won't know whether the file doesn't exist or if there's a permission issue. Consider logging errors or at least distinguishing between ENOENT and EACCES.

[greptile-apps]

How will customers discover this _FILE suffix feature? No documentation found in the /docs folder for Docker secrets or _FILE environment variables.