Skip to content

[P1][security] validateJwtSecret should fail-closed on any default secret in non-dev envs #3737

@PierreBrisorgueil

Description

@PierreBrisorgueil

P0-hardening follow-up from 2026-05-29 Trawl audit (infra docs/superpowers/plans/2026-05-29-trawl-audit-p0p1.md). Trawl prod was found signing JWTs with the committed per-project default TrawlNodeDevSecret (mitigated in infra by injecting a real secret). Root cause is permissive validation: lib/helpers/config.js:62 validateJwtSecret only console.logs a warning, and only for the devkit placeholder WaosSecretKeyExampleToChnageAbsolutely — it misses any downstream project default and never throws. Fix: in non-dev/test envs, throw (crash-loop loud) when jwt secret is empty, a known default, or < 32 chars; keep dev warning. Also tighten modules/home/services/home.service.js:131-136 readiness check to same rule. Propagate downstream via /update-stack. ⚠️ Downstream projects must inject a real DEVKIT_NODE_jwt_secret BEFORE this lands or pods crash-loop.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions