🔒 [security fix] Remove hardcoded JWT secret

.jules/sentinel.md

@@ -0,0 +1,6 @@
+# Sentinel Security Learnings
+
+## Hardcoded Secrets
+- **Vulnerability**: Hardcoding default secrets in the codebase (e.g., `const JWT_SECRET = process.env.JWT_SECRET || 'default-secret'`) is a significant risk. If the environment variable is not set, the application falls back to a known secret, allowing attackers to forge tokens or decrypt data.
+- **Fix**: Always require critical secrets to be provided via environment variables. Use a "fail-fast" approach by throwing an error during application initialization if a required secret is missing.
+- **Best Practice**: Document the required environment variables in a `.env.example` file or the `README.md` using placeholders (e.g., `JWT_SECRET=your_jwt_secret_here`) instead of real or "safe" looking defaults.

README.md

@@ -46,7 +46,7 @@ npm run dev
 1. Create a `.env` file in the `backend` directory:
 ```env
 DATABASE_URL="postgresql://user:password@localhost:5432/secure_notes?schema=public"
-JWT_SECRET="your-secret-key-change-in-production"
+JWT_SECRET="your_jwt_secret_here"
 PORT=3000
 ```
 
@@ -116,7 +116,7 @@ railway up
 4. Set environment variables:
 ```bash
 railway variables set DATABASE_URL="your-postgres-url"
-railway variables set JWT_SECRET="your-secret-key"
+railway variables set JWT_SECRET="your_jwt_secret_here"
 railway variables set PORT=3000
 ```
 

backend/src/middleware/auth.ts

@@ -9,7 +9,13 @@ export interface AuthRequest extends Request {
  userId?: string;
 }
 
-const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
+const secret = process.env.JWT_SECRET;
+
+if (!secret) {
+ throw new Error('JWT_SECRET environment variable is not set');
+}
+
+const JWT_SECRET: string = secret;
 
 export function authenticateToken(
  req: AuthRequest,