Hardcoded JWT Signing Key (ARCH5137)

Key go.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321

Embedding a JWT/HMAC signing key as a literal in source compromises token integrity the moment the source leaks. An attacker can then sign their own valid tokens.

Incorrect

token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
signed, _ := token.SignedString([]byte("super-secret-key"))

Correct

secret := []byte(os.Getenv("JWT_SIGNING_KEY"))
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
signed, _ := token.SignedString(secret)

Fix

Read the signing key from an environment variable or a secret manager; never embed it in code.