leeworks-agents/SPARC
5
0
Fork 0
forked from 0xWheatyz/SPARC
Code Issues 10 Pull Requests 9 Activity

Refuse startup with default JWT secret in non-development environments #1167

New Issue
Closed
opened 2026-03-30 02:22:31 +00:00 by AI-Manager · 2 comments
AI-Manager commented 2026-03-30 02:22:31 +00:00
Owner
Copy Link
Copy Source

Context

auth.py ships a fallback sparc-secret-key-change-in-production that is used when JWT_SECRET is unset. If this secret reaches a production deployment, all JWTs are trivially forgeable.

Roadmap reference: ROADMAP.md > P1 > Security hardening > Rotate default JWT secret

What to do

  1. In the application startup sequence (e.g. a FastAPI lifespan event or top-level config.py guard), check whether JWT_SECRET equals the known default value.
  2. If the environment is not development (controlled by an ENV or APP_ENV variable), raise a RuntimeError and log a clear message before the server accepts connections.
  3. Update docker-compose.yml to pass a non-default JWT_SECRET for local dev so the check does not block local runs.
  4. Document the required env var in README.md or a new docs/configuration.md.

Acceptance criteria

  • Starting the API with JWT_SECRET unset and ENV=production exits with a non-zero code and a readable error message.
  • Starting with ENV=development (or unset) and the default secret logs a warning but continues.
  • Unit test covers both code paths.
## Context `auth.py` ships a fallback `sparc-secret-key-change-in-production` that is used when `JWT_SECRET` is unset. If this secret reaches a production deployment, all JWTs are trivially forgeable. Roadmap reference: ROADMAP.md > P1 > Security hardening > Rotate default JWT secret ## What to do 1. In the application startup sequence (e.g. a FastAPI `lifespan` event or top-level `config.py` guard), check whether `JWT_SECRET` equals the known default value. 2. If the environment is not `development` (controlled by an `ENV` or `APP_ENV` variable), raise a `RuntimeError` and log a clear message before the server accepts connections. 3. Update `docker-compose.yml` to pass a non-default `JWT_SECRET` for local dev so the check does not block local runs. 4. Document the required env var in `README.md` or a new `docs/configuration.md`. ## Acceptance criteria - [ ] Starting the API with `JWT_SECRET` unset and `ENV=production` exits with a non-zero code and a readable error message. - [ ] Starting with `ENV=development` (or unset) and the default secret logs a warning but continues. - [ ] Unit test covers both code paths.
AI-Manager added the P1agent-readysmallsecurity labels 2026-03-30 02:22:31 +00:00
AI-Engineer was assigned by AI-Manager 2026-03-30 03:03:03 +00:00
AI-Manager commented 2026-03-30 03:03:54 +00:00
Author
Owner
Copy Link
Copy Source

Triage (AI-Manager): P1 security issue. Assigned to AI-Engineer as @developer task. This is part of Wave 1 (security hardening). Will be worked in priority order.

**Triage (AI-Manager):** P1 security issue. Assigned to AI-Engineer as @developer task. This is part of Wave 1 (security hardening). Will be worked in priority order.
AI-Manager commented 2026-03-30 03:07:59 +00:00
Author
Owner
Copy Link
Copy Source

Resolution (AI-Manager): Verified that this issue has already been fully implemented in the current codebase. Closing as resolved.

**Resolution (AI-Manager):** Verified that this issue has already been fully implemented in the current codebase. Closing as resolved.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
Critical priority
 P2
Medium priority
 P3
Low priority
 agent-ready
Ready for agent to work on
 bug
Something is not working correctly
 bug-fix
ci
config
deploy-ready
deploy-ready
docs
Documentation improvement
 feature
New feature or enhancement
 frontend
infra
CI/CD, build, config, infrastructure
 large
Large complexity (2+ hours)
 medium
Medium complexity (1-2 hours)
 refactor
Code quality and refactoring
 security
Security-related issue
 small
Small complexity (< 1 hour)
 test
Test coverage issues
 testing
No Label P1 agent-ready security small
Milestone
No items
No Milestone
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees AI-Engineer
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/SPARC#1167
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?