Ensure IS_VERBOSE_DEV_MODE is disabled in production config

- Add explicit security comment to config/instance-config.js
- Add regression test to verify IS_VERBOSE_DEV_MODE is false
- Verify IS_DEV_MODE is false

Note: The configuration file was found to be already set to `false` in the environment. This change enforces the policy.

Co-authored-by: PR0M3TH3AN <[email protected]>

config/instance-config.js

@@ -33,6 +33,8 @@ export const IS_DEV_MODE = false;
  * a quieter dev mode without disabling other development helpers entirely.
  * Use the runtime override documented in `js/config.js` if you need to toggle
  * verbosity without editing this file.
+ *
+ * Security: This must be false in production.
  */
 export const IS_VERBOSE_DEV_MODE = false;
 

tests/unit/security-config.test.mjs

@@ -0,0 +1,11 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { IS_DEV_MODE, IS_VERBOSE_DEV_MODE } from '../../config/instance-config.js';
+
+test('Security configuration: IS_VERBOSE_DEV_MODE must be false', () => {
+  assert.strictEqual(IS_VERBOSE_DEV_MODE, false, 'IS_VERBOSE_DEV_MODE should be false in production');
+});
+
+test('Security configuration: IS_DEV_MODE must be false', () => {
+  assert.strictEqual(IS_DEV_MODE, false, 'IS_DEV_MODE should be false in production');
+});