Hardcoded JWT signing key (ARCH2137)

Key python.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321

Keeping a JWT or HMAC signing key as a literal in source completely breaks token integrity once the code leaks. An attacker who obtains the key can forge valid tokens.

Incorrect

import jwt

token = jwt.encode({"sub": user_id}, "super-secret-key", algorithm="HS256")

Correct

import jwt
import os

secret = os.environ["JWT_SIGNING_KEY"]
token = jwt.encode({"sub": user_id}, secret, algorithm="HS256")

Fix

Read the signing key from an environment variable or a secrets manager; never embed it in code.