The HMAC key passed to JWT.encode / JWT.decode is a hard-coded string literal.

Why this matters

This key signs and verifies every token: committed to source control it is one search away from compromise, letting an attacker forge a token for any user or role (CWE-798). AI-generated samples inline the secret to make the snippet "just work" and it ships unchanged.

Read the key from the environment or Rails credentials instead: JWT.encode(payload, ENV.fetch('JWT_SECRET'), 'HS256') JWT.decode(token, Rails.application.credentials.jwt_secret, true, { algorithm: 'HS256' })

require 'jwt'

def issue(payload)
  # ruleid: auth.ruby.secret.hardcoded-jwt-secret
  JWT.encode(payload, 'sup3r-s3cret-signing-key', 'HS256')
end

def verify(token)
  # ruleid: auth.ruby.secret.hardcoded-jwt-secret
  JWT.decode(token, 'sup3r-s3cret-signing-key', true, { algorithm: 'HS256' })
end

require 'jwt'

def issue(payload)
  # ok: key read from the environment, not a literal
  JWT.encode(payload, ENV.fetch('JWT_SECRET'), 'HS256')
end

def verify(token)
  # ok: key read from Rails credentials
  JWT.decode(token, Rails.application.credentials.jwt_secret, true, { algorithm: 'HS256' })
end

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.secret.hardcoded-jwt-secret -- <reason>

References