sandrodachandClaude Opus 5.5 4cdbcbd6b5 fix(security): never sign tokens with a known JWT secret (FLAW-04) ...

Without JWT_SECRET, or with one of the published placeholders, the server
generates 32 random bytes once and keeps them in the data directory
(jwt.secret, mode 0600), so tokens cannot be forged and logins survive
restarts. Instances that ran on the old default log in once more.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 07:35:45 +01:00

..

config_test.go

fix(security): never sign tokens with a known JWT secret (FLAW-04)

2026-10-29 07:35:45 +01:00

config.go

fix(security): never sign tokens with a known JWT secret (FLAW-04)

2026-10-29 07:35:45 +01:00