documenso-multi-env-setup

No malicious behavior or intentional data exfiltration is evident. The main security risk is incorrect environment isolation: forceEnvironment does not control the configuration loaded, allowing a supposedly staging or production client to use NODE_ENV-selected credentials and URL. The webhook secret naming mismatch may also result in empty secrets and weakened webhook verification. Correctness issues include the undefined loadConfigForEnv reference and potentially misleading client caching. API keys should remain in a secret manager or protected environment, and configuration loading should accept the explicitly selected environment and validate webhook secrets.