Secret with a hardcoded fallback value
Scan rule · RSC-SEC-146
- Security
- Severity: High
- CWE-798
- OWASP A07-2021
Finds secrets read from the environment with a hardcoded fallback (`process.env.JWT_SECRET || "dev-secret"`, `?? "…"`) — public prefixes (NEXT_PUBLIC …) excluded.
Why this matters
AI generators write `const secret = process.env.JWT_SECRET || "dev-secret"` so the app starts even without the variable set. Convenient locally — fatal in production: if the variable is missing on the server (a common misconfiguration), the app silently keeps running with the value from the source code instead of refusing to start.
For a signing or session key that fallback is publicly known — it is in the repository. Anyone who knows it forges valid tokens or takes over other people's sessions. The mistake is invisible because nothing crashes: the app works, just with a key everyone knows.
Fix: remove the fallback. If the variable is missing, abort startup (`if (!process.env.JWT_SECRET) throw new Error("JWT_SECRET missing")`). Treat the previously hardcoded value as compromised and rotate it.
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Set no fallback: if the variable is missing, abort startup with an error — and rotate the previously hardcoded value as compromised.