Action Center4
SEC-1427 · secrets/private-key

Hard-coded production signing key

Canonical finding workspace: evidence, blast radius, remediation, and independent validation remain separately auditable.

CriticalPR openedNot run
northstar/core-platformservices/auth/src/jwt.ts:38
Confidence
Confirmed
Owner
Maya Chen
First observed
25 Aug 2026, 07:02 UTC
SLA remaining
1h 42m
Source run
RUN-8842
Fingerprint
fp:jwt.ts:38:91b2f1

Why this matters

Human-readable impact grounded in the verified target snapshot

A production signing key is committed to source and reachable by the authentication service.

An actor with repository read access could mint trusted session tokens. Rotation alone is insufficient until the committed key is removed from history and dependent credentials are invalidated.

Entry pointPOST /v1/session
Runtime pathauth-api → jwt.sign
EnvironmentProduction
ExploitabilityConfirmed

Evidence

Source provenance and integrity for every claim

1 verified artifact
Private key material detected in sourceEVD-9921 · git blob 8e9ac77
Verified
37 const algorithm = "RS256";
38 const key = "-----BEGIN PRIVATE KEY-----…";
39 return sign(payload, key, { algorithm });
Collector
Securite Secret Scanner 2.9.1
Observed
25 Aug 2026, 07:02:11 UTC
Captured
25 Aug 2026, 07:02:15 UTC
Content hash
sha256:91b2f1…ce40
Freshness
Fresh
Access scope
workspace:core-platform