[Security]: Hardcoded weak JWT_SECRET in .env example and plain-text demo passwords in README — immediate security risk for all deployments

[prince-pokharna]

security, critical, bug, GSSoC 2026

Summary

⚠️ This is a critical security issue affecting all live StackIt deployments.

The README.md instructs developers to use your-super-secret-jwt-key as their JWT_SECRET. This placeholder is a dictionary-guessable string that many contributors copy verbatim into their .env file — including any public-facing demo deployments. Additionally, demo user passwords (password123) are published openly in the README, making all demo accounts trivially accessible to anyone who reads the documentation.

Problem

• The suggested JWT_SECRET (your-super-secret-jwt-key) is a low-entropy string that would be cracked instantly by any JWT brute-force tool.
• password123 is published as the demo credential for all demo accounts in the README.
• The JWT_SECRET signs all user sessions including admin access — a compromised secret enables full authentication bypass via token forgery.
• There is no startup validation enforcing minimum secret strength.
• There is no SECURITY.md or responsible disclosure process.

Impact

• Any live StackIt deployment using the README's suggested JWT_SECRET is completely compromised — an attacker can forge any user's JWT token and gain admin access.
• All demo accounts on any public StackIt instance are trivially accessible.

Proposed Solution

1. Add startup validation that rejects weak JWT secrets:

// server/index.js — add at startup
if (!process.env.JWT_SECRET || process.env.JWT_SECRET.length < 32) {
  console.error(`
FATAL: JWT_SECRET must be at least 32 characters long.
Generate a secure secret with this command:
  node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
  `);
  process.exit(1);
}

2. Update server/env.example to replace placeholder values with generation instructions:

# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
JWT_SECRET=<generate-a-strong-random-secret-minimum-32-chars>

3. Remove all demo plaintext passwords from the README and replace with instructions for seeding a local dev database.

4. Add a SECURITY.md documenting credential rotation and responsible disclosure.

I am participating in GSSoC 2026. Could you please assign this issue to me?

[prince-pokharna]

Hey @Ashmita1206 ,
Please assign it to me under GSSoC 2026.
/assign /claim /claim-assignment