Security: hCaptcha keys can be nil in production, silently disabling captcha

[philipithomas]

Description

In config/initializers/recaptcha.rb:4-11, if HCAPTCHA_SITE_KEY and HCAPTCHA_SECRET_KEY environment variables are not set in production, the keys will be nil, potentially disabling captcha validation entirely.

Recommendation

Validate presence of these keys on boot and raise an error if missing in production.

Severity

Medium