Root Compose boots when the production secrets the README says are required are unset #113

What is wrong

The production install says SITMUN_USER_SECRET and MIDDLEWARE_SECRET are mandatory and that Compose refuses to start when they are missing. The root docker-compose.yml substitutes committed development defaults instead. profiles/postgres.env and profiles/oracle.env do not set either variable. Copying one of those files to .env and running docker compose up therefore starts the backend and proxy on the development defaults.

Where

• README.md lines 198-204 and 214-227 say both secrets are mandatory, that the compose profile marks them required with :?, and that a missing variable makes Compose refuse to start. Lines 267-268 list them as required in production profiles. Lines 884-902 say production must supply both values and must not reuse the development defaults.
• profiles/postgres.env and profiles/oracle.env leave MIDDLEWARE_SECRET commented out and do not set SITMUN_USER_SECRET.
• docker-compose.yml lines 114-115 default SITMUN_USER_SECRET and SITMUN_PROXY_MIDDLEWARE_SECRET (from MIDDLEWARE_SECRET). Line 151 defaults SITMUN_BACKEND_CONFIG_SECRET from MIDDLEWARE_SECRET. Line 153 defaults SITMUN_MBTILES_JOB_HANDLE_SECRET. The committed values are development defaults. They are not copied here.
• The standalone files do require the first two: profiles/postgres/docker-compose.yml lines 63-64 and profiles/oracle/docker-compose.yml lines 66-67 use :?. The production steps at README.md lines 185-189 run the root compose file, not those standalone files.

A stack boot was not run.

Why it matters

A deployer who follows the production steps and does not generate secrets still gets a running backend and proxy that sign tokens with the committed development defaults.

Smallest fix

In the root docker-compose.yml, require SITMUN_USER_SECRET, MIDDLEWARE_SECRET, and SITMUN_MBTILES_JOB_HANDLE_SECRET with :?, as the standalone profile files already do for the first two. Tell the development quick start to generate those values into .env. Do not commit the values.