Hardcoded JWT Signing Key (ARCH9137)

Key swift.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321

Flags JWT signers created with a literal secret (JWTSigner.hs256(key:), HMAC key from a string literal).

Incorrect

let signer = JWTSigner.hs256(key: "change-me-secret")

Correct

let signer = JWTSigner.hs256(key: Environment.get("JWT_SECRET")!)

Fix

Load the signing key from configuration; rotate it if it was ever committed.