Config from the environment, and graceful shutdown

Secrets live in the environment, and the app fails loud without them

You saw process.env.CORS_ORIGIN and process.env.PORT already. That's the 12-factor rule: config that changes between environments — database URLs, the JWT secret, Stripe keys — lives in environment variables, never in the code or git. One image runs unchanged in dev, staging, and production; only the environment differs.

The senior habit is fail-fast: check every required variable at startup and refuse to boot if one is missing. A crash on line one, before you accept a single request, is a good outage. A JWT_SECRET that's silently undefined — signing every token with 'undefined' — is a catastrophic one you find in production.

In an interview, say: Config comes from the environment and I validate it at boot — if a required secret is missing the process exits immediately. I'd rather fail the deploy than run half-configured and leak it later.