GKaszewski/k-tv
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

Hardcoded default COOKIE_SECRET with no production guard #18

New Issue
Open
opened 2026-07-25 11:16:33 +00:00 by GKaszewski · 0 comments
GKaszewski commented 2026-07-25 11:16:33 +00:00
Owner
Copy Link

Severity: Critical

crates/infra-wiring/src/lib.rs has a hardcoded default COOKIE_SECRET in source code with no production guard. The JWT adapter correctly rejects weak secrets in production mode, but the cookie secret has no equivalent check.

An operator who forgets to set COOKIE_SECRET gets a readable default baked into the binary. Add a production-mode check that panics on startup if the default is used.

**Severity: Critical** `crates/infra-wiring/src/lib.rs` has a hardcoded default `COOKIE_SECRET` in source code with no production guard. The JWT adapter correctly rejects weak secrets in production mode, but the cookie secret has no equivalent check. An operator who forgets to set `COOKIE_SECRET` gets a readable default baked into the binary. Add a production-mode check that panics on startup if the default is used.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
needs-triage
Maintainer needs to evaluate this issue
 prd
Product Requirements Document
 ready-for-agent
Fully specified, ready for an AFK agent
 ready-for-human
Requires human implementation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GKaszewski
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: GKaszewski/k-tv#18
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?