ERT-SECRETS-012
Hardcoded or weak JWT/session secret
HighA04:2025CWE-321
Why it matters
API keys in your JavaScript, .env files, .git folders, source maps. This check looks specifically for: hardcoded or weak jwt/session secret.
How to fix it
Open the finding in Emerald Red Team for a fix prompt tailored to your stack and AI tool.
How we test it
Code — reads your connected repository.
Does your app have this problem?
Create a free account and verify your app to test for it.
Scan my app — free