Will It Vibe?Hardcoded JWT signing key
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A SymmetricSecurityKey is built from Encoding.*.GetBytes() of a string literal instead of a value read from configuration or a secret store. Anyone with the source can forge a validly-signed token for any user.
Why it matters
A JWT signing key that is a string literal in source code is available to anyone who can read the repository, and with it they can mint a validly-signed token for any user or role your application accepts, including an administrator. Because source control history is durable, this key remains exploitable long after the line is removed unless it is also rotated.
How to fix it
Move the signing key into configuration bound from environment variables, .NET user-secrets locally, or a managed secret store such as Azure Key Vault in production, and read it via IConfiguration rather than embedding it as a literal. Generate a new, sufficiently long random key to replace the old one, since the old key must be treated as compromised, and invalidate tokens signed with it if your token lifetime allows it to still be valid.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo