From 266faaa1c91b3c3f350da41de74e5cb73d27732f Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 18 Feb 2026 19:35:17 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20fix:=20remove=20hardcoded=20JWT?=
 =?UTF-8?q?=20secret=20and=20require=20env=20var?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removed the insecure fallback for JWT_SECRET in the authentication
middleware. The application now throws an error at startup if the
JWT_SECRET environment variable is not defined. Updated README.md
to reflect this requirement.

Co-authored-by: davidraehles <6085055+davidraehles@users.noreply.github.com>
---
 .jules/sentinel.md             | 6 ++++++
 README.md                      | 4 ++--
 backend/src/middleware/auth.ts | 8 +++++++-
 3 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..3acc66f
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,6 @@
+# Sentinel Security Learnings
+
+## Hardcoded Secrets
+- **Vulnerability**: Hardcoding default secrets in the codebase (e.g., `const JWT_SECRET = process.env.JWT_SECRET || 'default-secret'`) is a significant risk. If the environment variable is not set, the application falls back to a known secret, allowing attackers to forge tokens or decrypt data.
+- **Fix**: Always require critical secrets to be provided via environment variables. Use a "fail-fast" approach by throwing an error during application initialization if a required secret is missing.
+- **Best Practice**: Document the required environment variables in a `.env.example` file or the `README.md` using placeholders (e.g., `JWT_SECRET=your_jwt_secret_here`) instead of real or "safe" looking defaults.
diff --git a/README.md b/README.md
index 3f8a0f2..773d257 100644
--- a/README.md
+++ b/README.md
@@ -46,7 +46,7 @@ npm run dev
 1. Create a `.env` file in the `backend` directory:
 ```env
 DATABASE_URL="postgresql://user:password@localhost:5432/secure_notes?schema=public"
-JWT_SECRET="your-secret-key-change-in-production"
+JWT_SECRET="your_jwt_secret_here"
 PORT=3000
 ```
 
@@ -116,7 +116,7 @@ railway up
 4. Set environment variables:
 ```bash
 railway variables set DATABASE_URL="your-postgres-url"
-railway variables set JWT_SECRET="your-secret-key"
+railway variables set JWT_SECRET="your_jwt_secret_here"
 railway variables set PORT=3000
 ```
 
diff --git a/backend/src/middleware/auth.ts b/backend/src/middleware/auth.ts
index 7511aee..db9721b 100644
--- a/backend/src/middleware/auth.ts
+++ b/backend/src/middleware/auth.ts
@@ -9,7 +9,13 @@ export interface AuthRequest extends Request {
   userId?: string;
 }
 
-const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
+const secret = process.env.JWT_SECRET;
+
+if (!secret) {
+  throw new Error('JWT_SECRET environment variable is not set');
+}
+
+const JWT_SECRET: string = secret;
 
 export function authenticateToken(
   req: AuthRequest,