[LOW] Enforce JWT_SECRET at startup - remove insecure fallback #46

New issue

Closed

opened 2026-06-09 00:03:13 +00:00 by Mark · 0 comments

Mark commented

2026-06-09 00:03:13 +00:00

Owner

Location: backend/src/auth.ts:6-14

Problem: JWT fallback secret your-secret-key-change-in-production allows the app to start insecurely without explicit misconfiguration detection.

Impact: App runs with trivially guessable signing key in production if env var is missing.

Fix:

if (!process.env.JWT_SECRET) {
  throw new Error("JWT_SECRET is required");
}

Effort: ~5 mins

**Location:** `backend/src/auth.ts:6-14` **Problem:** JWT fallback secret `your-secret-key-change-in-production` allows the app to start insecurely without explicit misconfiguration detection. **Impact:** App runs with trivially guessable signing key in production if env var is missing. **Fix:** ```ts if (!process.env.JWT_SECRET) { throw new Error("JWT_SECRET is required"); } ``` **Effort:** ~5 mins