v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.betterauth.hardcoded-secret

The better-auth secret is set to a hard-coded string literal.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This value signs and encrypts every session cookie, CSRF token, and verification token better-auth issues. Committed to git it is one search away from compromise, letting an attacker forge sessions for any user.

Read it from the environment instead: secret: process.env.BETTER_AUTH_SECRET (better-auth also falls back to the BETTER_AUTH_SECRET / AUTH_SECRET env vars automatically if you omit the option). Add the variable to .env.example with a placeholder and rotate any secret that has shipped.

VULNERABLE
vulnerable.ts
import { betterAuth } from "better-auth";

// A hard-coded better-auth secret: signs/encrypts every session cookie and
// token. Committed to git it lets an attacker forge sessions for any user.
// ruleid: auth.betterauth.hardcoded-secret
export const auth = betterAuth({
  secret: "sup3r-s3cret-signing-value-committed",
  emailAndPassword: {
    enabled: true,
  },
});
SAFE
safe.ts
import { betterAuth } from "better-auth";

// Secret read from the environment (better-auth's documented fallback chain:
// options.secret > BETTER_AUTH_SECRET > AUTH_SECRET).
export const auth = betterAuth({
  secret: process.env.BETTER_AUTH_SECRET as string,
  emailAndPassword: {
    enabled: true,
  },
});

// Placeholder secrets in scaffolding must not fire.
export const scaffold = betterAuth({
  secret: "your-better-auth-secret-here",
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.betterauth.hardcoded-secret -- <reason>

References

https://www.better-auth.com/docs/reference/options ↗https://cwe.mitre.org/data/definitions/798.html ↗