Hardcoded JWT Signing Key (ARCH6137)

Key ruby.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321

Embedding a JWT signing key as a string literal destroys token integrity once the source leaks, letting attackers forge valid tokens. Read the key from the environment.

Incorrect

require "jwt"

token = JWT.encode(payload, "super-secret-key", "HS256")

Correct

require "jwt"

secret = ENV.fetch("JWT_SIGNING_KEY")
token = JWT.encode(payload, secret, "HS256")

Fix

Read the signing key from an environment variable or a secrets manager.