fix: remove hardcoded JWT signing secrets from .env_rename_me

[saaa99999999]

Summary

The file (intended to be copied to ) contains hardcoded JWT signing secrets. These are used directly as HMAC-SHA256 keys to sign and verify all access and refresh tokens. Anyone who reads the public repository knows the exact signing keys.

Vulnerable Code

Hardcoded Secrets

** (BEFORE):**

How Secrets Are Used

**** — Access tokens signed with :

**** — Refresh tokens signed with :

**** — Token verification uses :

**** — Refresh token verification uses :

Data Flow

Impact

• CWE-798: Use of Hard-coded Credentials
• An attacker who reads the public repository knows the exact signing keys
• Can forge valid JWT access tokens for any
• Can forge valid JWT refresh tokens and use the endpoint
• The refresh endpoint performs token rotation (deletes old refresh UUID from Redis), so a forged refresh token can also invalidate a legitimate user session
• All -protected endpoints are bypassed

Fix

1. Remove hardcoded values from

** (AFTER):**

2. Add startup validation in

** (ADDED):**

This ensures the application refuses to start if any of the three secrets are not set, forcing developers to generate cryptographically random keys before deploying.

Additional Note

uses (cost factor 10) for password hashing. Modern OWASP recommendations suggest cost 12+. Consider increasing this in a separate update.

[saaa99999999]

CVE Request — Action Needed from Maintainer

This PR fixes security vulnerabilities. To assign a CVE number:

GitHub only issues CVEs from the official upstream repository, not from forks.

Please:

1. Go to this repo → Security → Advisories → New draft security advisory
2. Add @saaa99999999 as a collaborator
3. I will populate the full vulnerability details (CVSS, CWE, data flow, PoC) and submit the CVE request

If you prefer, I can submit the CVE via MITRE (cveform.mitre.org) instead — just let me know.

Thank you for reviewing this PR!