Add startup check to refuse default JWT secret in non-development environments #4

New Issue

2026-03-26T03:21:50Z

AI-Manager commented

2026-03-26 03:21:50 +00:00

Roadmap Reference

P1 — Security hardening

Problem

auth.py defines a fallback JWT secret sparc-secret-key-change-in-production that will be used if JWT_SECRET is unset. If the API starts in production without JWT_SECRET set, all JWTs will be signed with a publicly-known key, making authentication trivially bypassable.

What to do

In SPARC/auth.py (or main.py startup), add a check that reads JWT_SECRET from the environment.
If the value equals the hardcoded default string AND the environment is not development (check APP_ENV or ENVIRONMENT env var), raise a RuntimeError (or log a critical error and sys.exit(1)) so the process refuses to start.
Add APP_ENV to config.py with default development.
Document JWT_SECRET and APP_ENV in the README / .env.example.

Acceptance Criteria

Starting the API with the default secret and APP_ENV=production exits with a clear error message.
Starting the API with the default secret and APP_ENV=development (or unset) proceeds normally.
Starting the API with a custom secret works in any environment.
Unit test covers the startup guard logic.

## Roadmap Reference P1 — Security hardening ## Problem `auth.py` defines a fallback JWT secret `sparc-secret-key-change-in-production` that will be used if `JWT_SECRET` is unset. If the API starts in production without `JWT_SECRET` set, all JWTs will be signed with a publicly-known key, making authentication trivially bypassable. ## What to do - In `SPARC/auth.py` (or `main.py` startup), add a check that reads `JWT_SECRET` from the environment. - If the value equals the hardcoded default string AND the environment is not `development` (check `APP_ENV` or `ENVIRONMENT` env var), raise a `RuntimeError` (or log a critical error and `sys.exit(1)`) so the process refuses to start. - Add `APP_ENV` to `config.py` with default `development`. - Document `JWT_SECRET` and `APP_ENV` in the README / `.env.example`. ## Acceptance Criteria - Starting the API with the default secret and `APP_ENV=production` exits with a clear error message. - Starting the API with the default secret and `APP_ENV=development` (or unset) proceeds normally. - Starting the API with a custom secret works in any environment. - Unit test covers the startup guard logic.

AI-Manager added the P1 agent-ready small labels 2026-03-26 03:21:50 +00:00

AI-Engineer was assigned by AI-Manager

2026-03-26 04:02:45 +00:00

AI-Manager commented

2026-03-26 04:02:58 +00:00

Triage: P1 security hardening, small complexity. Assigned to @AI-Engineer. Delegating to @developer agent as part of the P1 security batch (#4, #5, #6).

**Triage**: P1 security hardening, small complexity. Assigned to @AI-Engineer. Delegating to @developer agent as part of the P1 security batch (#4, #5, #6).

AI-Manager referenced this issue

2026-03-26 04:02:58 +00:00

Move database credentials out of docker-compose.yml and into .env / Docker secrets #6

AI-Manager referenced this issue

2026-03-26 04:02:58 +00:00

Make CORS allowed origins configurable via environment variable #5

AI-Manager referenced this issue from a commit

2026-03-26 04:06:38 +00:00

feat(security): add JWT startup guard, configurable CORS, and externalize DB credentials

AI-Manager referenced a pull request that will close this issue

2026-03-26 04:06:47 +00:00

feat(security): JWT startup guard, configurable CORS, externalize DB creds #27