Hardcoded JWT signing key (ARCH3137)

Key typescript.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321

Embedding a JWT/HMAC signing key as a literal in source compromises token integrity once the source leaks. Read the key from configuration or a secrets manager.

Incorrect

import jwt from "jsonwebtoken";

const token = jwt.sign({ sub: user.id }, "super-secret-key-123");

Correct

import jwt from "jsonwebtoken";

const secret = process.env.JWT_SIGNING_KEY!;
const token = jwt.sign({ sub: user.id }, secret);

Fix

Load the signing key from an environment variable or secrets manager; never keep it as a literal in source.