Supabase and API config is read three different ways, with hardcoded production fallbacks

[royalpinto007]

Problem

There are three different, mutually inconsistent ways to get the Supabase URL and anon key in this codebase:

1. src/utils/supabaseClient.ts falls back to hardcoded literals when the env vars are absent:

   const FALLBACK_SUPABASE_URL = "https://qcvnfvbzxbnrquxtjihp.supabase.co";
   const FALLBACK_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIs...";

2. src/app/(site)/prospects/savedProspectsData.ts asserts at module scope: process.env.NEXT_PUBLIC_SUPABASE_URL!.
3. src/app/(site)/prospect/[id]/prospectData.ts checks defensively and silently returns null if either is missing.

The API base URL has the same split: prospectActions.ts and useContactForm.ts read process.env.NEXT_PUBLIC_API_BASE_URL ?? "https://api.signalizeai.org", while useUserPlan.ts and payment-success/paymentUtils.ts just hardcode https://api.signalizeai.org and ignore the env var entirely.

Why it matters

• The hardcoded fallbacks mean a misconfigured preview or local environment silently talks to the production project instead of failing. That is how test data ends up in prod.
• Rotating the anon key requires a code change and a redeploy, not a config change.
• Because two of the four API call sites ignore NEXT_PUBLIC_API_BASE_URL, you cannot actually point the site at a staging API. The env var is half-wired, which is worse than not existing, because it looks like it works.
• The ! assertions in savedProspectsData.ts produce "undefined" strings inside a URL rather than a readable error.

Suggested approach

1. Add src/config.ts exporting SUPABASE_URL, SUPABASE_ANON_KEY, and API_BASE_URL, each read once and each throwing a named error at import time if missing.
2. Delete the two FALLBACK_ constants and all three ad hoc reads.
3. Replace every hardcoded https://api.signalizeai.org with API_BASE_URL.
4. Add a .env.example documenting all three, and mention them in the README setup steps.

Done when

• grep -rn "qcvnfvbzxbnrquxtjihp\|api.signalizeai.org" src returns nothing outside src/config.ts.
• A missing env var fails the build or the first render with a message naming the variable.

---

If you want to take this on, comment on the issue to claim it and it will be assigned. Please keep to a maximum of 2 open claims per person at a time so other contributors get a chance.