NextAuth Auth.js hardcoded secret in source code
Rule ID: vetkit.js.auth.hardcoded-auth-secret
The NextAuth / Auth.js / Better Auth secret is a string literal in the source code. It signs and encrypts session cookies and JWTs, so anyone who can read the code can forge a session for any user.
Last updated:
Suite: Security
javascript, typescript
The NextAuth / Auth.js / Better Auth secret is a string literal in the source code. It signs and encrypts session cookies and JWTs, so anyone who can read the code can forge a session for any user.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Read the secret from the environment (secret: process.env.AUTH_SECRET, or omit it and set AUTH_SECRET / NEXTAUTH_SECRET / BETTER_AUTH_SECRET), generate a long random value (openssl rand -base64 32) and rotate the committed one, which signs out every user.
References
Source: packages/engine/rules/sast/javascript.yml.
Related checks
- NextAuth allowDangerousEmailAccountLinking enabled
- NextAuth Auth.js debug: true logs tokens in production
- JavaScript eval() with a dynamic argument: code injection
- Node.js code injection: request input loads a module
- Node.js child_process command injection from user input
- Node.js child_process exec with a dynamic command string
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.