bug: Hardcoded JWT secret in test fixtures — use env var instead #61

New issue

Closed

opened 2026-05-15 13:36:54 +00:00 by Mark · 0 comments

Mark commented

2026-05-15 13:36:54 +00:00

Owner

backend/tests/fixtures/database.py contains a hardcoded JWT secret. While this is only in test fixtures, best practice is to use an environment variable.

Recommendation: replace with os.environ.get("OSINT_JWT_SECRET", "test-secret-change-me") or use a test settings override.

backend/tests/fixtures/database.py contains a hardcoded JWT secret. While this is only in test fixtures, best practice is to use an environment variable. Recommendation: replace with os.environ.get("OSINT_JWT_SECRET", "test-secret-change-me") or use a test settings override.