HIGH: .env files with secrets (JWT_SECRET) are committed to git repository #5

New issue

Closed

opened 2026-05-09 00:00:20 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 00:00:20 +00:00

Owner

Severity: High

Location

Repository root .env, .env.production, backend/.env

Description

Three environment files containing secrets are tracked in git:

$ git ls-files .env* backend/.env*
.env
.env.production
backend/.env
backend/.env.example

backend/.env contains:

NODE_ENV=production
PORT=3001
JWT_SECRET=subvault-secret-key-change-in-production

While the .gitignore does list .env, these files were apparently added to the repo before the gitignore rules took effect and remain tracked.

Impact

The JWT signing secret is exposed in the repository history
Anyone with repo access can forge valid JWT tokens
This compounds issue #4 (disabled authentication) — when auth is re-enabled, attackers would know the secret

Suggested Fix

Remove the files from git tracking: git rm --cached .env .env.production backend/.env
Add .env.production to .gitignore explicitly (it is not covered by the current .env pattern, which only matches the exact filename .env)
Rotate the JWT secret
Add .env.* or .env.production to .gitignore

## Severity: High ## Location Repository root `.env`, `.env.production`, `backend/.env` ## Description Three environment files containing secrets are tracked in git: ``` $ git ls-files .env* backend/.env* .env .env.production backend/.env backend/.env.example ``` `backend/.env` contains: ``` NODE_ENV=production PORT=3001 JWT_SECRET=subvault-secret-key-change-in-production ``` While the `.gitignore` does list `.env`, these files were apparently added to the repo before the gitignore rules took effect and remain tracked. ## Impact - The JWT signing secret is exposed in the repository history - Anyone with repo access can forge valid JWT tokens - This compounds issue #4 (disabled authentication) — when auth is re-enabled, attackers would know the secret ## Suggested Fix 1. Remove the files from git tracking: `git rm --cached .env .env.production backend/.env` 2. Add `.env.production` to `.gitignore` explicitly (it is not covered by the current `.env` pattern, which only matches the exact filename `.env`) 3. Rotate the JWT secret 4. Add `.env.*` or `.env.production` to `.gitignore`