Ccodemod

codemod/secure-jwt-secret-keys

Identifies hardcoded JWT signing secrets in jsonwebtoken.sign() calls and replaces with env vars

securityjwtjsonwebtokenhardcoded-credentialsenvironment-variables
Public
0 executions
Use dashboardApply to Repository

Run locally

npx codemod @codemod/secure-jwt-secret-keys

@codemod/secure-jwt-secret-keys

Hardcoded JWT secret keys in jsonwebtoken.sign() calls pose a critical security vulnerability. When JWT signing secrets are embedded directly in source code, they can be exposed through version control, logs, or other means, allowing attackers to forge authentication tokens and completely bypass application security.

This codemod identifies hardcoded secrets and replaces them with secure environment variable references.

🚨 Security Issue

CWE-798: Use of Hard-coded Credentials

Hardcoded JWT secrets allow attackers to:

  • Forge authentication tokens
  • Bypass application security
  • Impersonate users
  • Access unauthorized resources

What it does

This codemod automatically transforms hardcoded JWT secrets to use environment variables:

Before

javascript

After

javascript

Supported patterns

The codemod handles all common JWT signing patterns:

  • Default imports: jwt.sign()
  • Named imports: sign() from { sign }
  • Namespace imports: jsonwebtoken.sign()
  • CommonJS: require('jsonwebtoken')
  • String literals: 'secret' and "secret"
  • Template literals: `secret-${env}`

Installation

bash

Usage

The codemod will scan your JavaScript/TypeScript files and:

  1. Detect hardcoded secrets in jwt.sign() calls
  2. Transform them to use process.env.JWT_SECRET
  3. Preserve all other function parameters and formatting
  4. Skip files that don't use jsonwebtoken

What gets transformed

✅ Will transform:

javascript

❌ Will NOT transform:

javascript

Configuration

After running the codemod, make sure to:

  1. Set the environment variable:
bash
  1. Add to your .env file:
text
  1. Use a strong secret:
bash

File patterns

The codemod processes these file types:

  • **/*.js - JavaScript files
  • **/*.ts - TypeScript files
  • **/*.jsx - React JavaScript files
  • **/*.tsx - React TypeScript files

Excluded patterns:

  • node_modules/ - Third-party dependencies
  • Test files (*.test.*, *.spec.*, __tests__/)
  • Configuration files (*.config.*)
  • Build outputs (dist/, build/)

Examples

React/Express app

javascript

Multiple import styles

javascript

Security References

Development

bash

Contributing

  1. Fork the repository
  2. Create a feature branch
  3. Add test cases for your changes
  4. Run pnpm test to ensure all tests pass
  5. Submit a pull request

License

MIT

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community