Both critical secrets are read with os.environ.get("TOKEN") (or similar) with no validation that the returned value is non-None. If the environment variable is absent, the value None is used silently in API calls, producing confusing Facebook API errors rather than a clear startup failure.