diff --git a/backend/tests/integration/env.test.ts b/backend/tests/integration/env.test.ts
new file mode 100644
index 0000000..91a2ba6
--- /dev/null
+++ b/backend/tests/integration/env.test.ts
@@ -0,0 +1,102 @@
+import { exec } from 'child_process';
+import path from 'path';
+import { describe, it, expect } from 'vitest';
+
+describe('Environment Variable Validation (Adversarial Stress)', () => {
+  const envJsPath = path.resolve(__dirname, '../../dist/config/env.js');
+
+  it('should exit with 1 when required environment variables are missing', () => {
+    return new Promise<void>((resolve, reject) => {
+      const testEnv = {
+        PATH: process.env.PATH,
+        NODE_ENV: 'test',
+      };
+
+      // Run from /tmp so dotenv cannot load the local backend/.env file
+      exec(`node ${envJsPath}`, { env: testEnv, cwd: '/tmp' }, (error, stdout, stderr) => {
+        try {
+          // Expect failure (exit code 1)
+          expect(error).not.toBeNull();
+          expect(error!.code).toBe(1);
+          expect(stderr).toContain('❌ Invalid environment configuration:');
+          expect(stderr).toContain('DATABASE_URL');
+          expect(stderr).toContain('JWT_SECRET');
+          resolve();
+        } catch (err) {
+          reject(err);
+        }
+      });
+    });
+  }, 15000);
+
+  it('should exit with 1 when DATABASE_URL is not a valid URL format', () => {
+    return new Promise<void>((resolve, reject) => {
+      const testEnv = {
+        PATH: process.env.PATH,
+        NODE_ENV: 'test',
+        DATABASE_URL: 'invalid-postgres-string',
+        JWT_SECRET: 'a'.repeat(32), // Valid length
+      };
+
+      exec(`node ${envJsPath}`, { env: testEnv, cwd: '/tmp' }, (error, stdout, stderr) => {
+        try {
+          // Expect failure (exit code 1)
+          expect(error).not.toBeNull();
+          expect(error!.code).toBe(1);
+          expect(stderr).toContain('❌ Invalid environment configuration:');
+          expect(stderr).toContain('DATABASE_URL');
+          expect(stderr).not.toContain('JWT_SECRET');
+          resolve();
+        } catch (err) {
+          reject(err);
+        }
+      });
+    });
+  }, 15000);
+
+  it('should exit with 1 when JWT_SECRET is too short', () => {
+    return new Promise<void>((resolve, reject) => {
+      const testEnv = {
+        PATH: process.env.PATH,
+        NODE_ENV: 'test',
+        DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/coaxyspanel',
+        JWT_SECRET: 'too-short', // Must be min 32 chars
+      };
+
+      exec(`node ${envJsPath}`, { env: testEnv, cwd: '/tmp' }, (error, stdout, stderr) => {
+        try {
+          // Expect failure (exit code 1)
+          expect(error).not.toBeNull();
+          expect(error!.code).toBe(1);
+          expect(stderr).toContain('❌ Invalid environment configuration:');
+          expect(stderr).not.toContain('DATABASE_URL');
+          expect(stderr).toContain('JWT_SECRET');
+          resolve();
+        } catch (err) {
+          reject(err);
+        }
+      });
+    });
+  }, 15000);
+
+  it('should pass validation (exit code 0) when all variables are valid', () => {
+    return new Promise<void>((resolve, reject) => {
+      const testEnv = {
+        PATH: process.env.PATH,
+        NODE_ENV: 'test',
+        DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/coaxyspanel',
+        JWT_SECRET: 'a'.repeat(32),
+      };
+
+      exec(`node ${envJsPath}`, { env: testEnv, cwd: '/tmp' }, (error, stdout, stderr) => {
+        try {
+          expect(error).toBeNull();
+          expect(stderr).toBe('');
+          resolve();
+        } catch (err) {
+          reject(err);
+        }
+      });
+    });
+  }, 15000);
+});