Hardcoded JWT signing key (ARCH338)

Key dotnet.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321

Embedding a JWT signing key in source code lets anyone with repo access mint valid tokens. This results in a complete bypass of the authentication mechanism.

Incorrect

var key = new SymmetricSecurityKey(
    Encoding.UTF8.GetBytes("super-secret-signing-key-123"));

Correct

var key = new SymmetricSecurityKey(
    Encoding.UTF8.GetBytes(configuration["Jwt:SigningKey"]!));
// Value comes from environment variable / secret store

Fix

Remove signing keys from source; load them from configuration, environment variables, or a secret store, and rotate them regularly.