diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..3acc66f
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,6 @@
+# Sentinel Security Learnings
+
+## Hardcoded Secrets
+- **Vulnerability**: Hardcoding default secrets in the codebase (e.g., `const JWT_SECRET = process.env.JWT_SECRET || 'default-secret'`) is a significant risk. If the environment variable is not set, the application falls back to a known secret, allowing attackers to forge tokens or decrypt data.
+- **Fix**: Always require critical secrets to be provided via environment variables. Use a "fail-fast" approach by throwing an error during application initialization if a required secret is missing.
+- **Best Practice**: Document the required environment variables in a `.env.example` file or the `README.md` using placeholders (e.g., `JWT_SECRET=your_jwt_secret_here`) instead of real or "safe" looking defaults.
diff --git a/README.md b/README.md
index 3f8a0f2..773d257 100644
--- a/README.md
+++ b/README.md
@@ -46,7 +46,7 @@ npm run dev
 1. Create a `.env` file in the `backend` directory:
 ```env
 DATABASE_URL="postgresql://user:password@localhost:5432/secure_notes?schema=public"
-JWT_SECRET="your-secret-key-change-in-production"
+JWT_SECRET="your_jwt_secret_here"
 PORT=3000
 ```
 
@@ -116,7 +116,7 @@ railway up
 4. Set environment variables:
 ```bash
 railway variables set DATABASE_URL="your-postgres-url"
-railway variables set JWT_SECRET="your-secret-key"
+railway variables set JWT_SECRET="your_jwt_secret_here"
 railway variables set PORT=3000
 ```
 
diff --git a/backend/src/middleware/auth.ts b/backend/src/middleware/auth.ts
index 7511aee..db9721b 100644
--- a/backend/src/middleware/auth.ts
+++ b/backend/src/middleware/auth.ts
@@ -9,7 +9,13 @@ export interface AuthRequest extends Request {
   userId?: string;
 }
 
-const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
+const secret = process.env.JWT_SECRET;
+
+if (!secret) {
+  throw new Error('JWT_SECRET environment variable is not set');
+}
+
+const JWT_SECRET: string = secret;
 
 export function authenticateToken(
   req: AuthRequest,