HIGH: Dev fallback SESSION_SECRET forgeable in production (env.ts:22)

[Inkcha]

Description

SESSION_SECRET in apps/web/lib/env.ts:22 defaults to "dev-only-insecure-change-me-0000000000000000" if not explicitly set via environment variable.

Impact

If this default reaches production, session token hashes (used in hashSessionToken()) are trivially forgeable. An attacker who knows this default can craft arbitrary session cookies and impersonate any user including admins.

Location

apps/web/lib/env.ts:22:

sessionSecret: process.env.SESSION_SECRET || "dev-only-insecure-change-me-0000000000000000",

Fix

1. Validate that SESSION_SECRET is set in production at startup
2. Remove the dev fallback or restrict it to development only
3. Rotate all existing sessions after deploying the fix

sessionSecret: (() => {
  const val = process.env.SESSION_SECRET;
  if (!val && process.env.NODE_ENV === 'production') {
    throw new Error('SESSION_SECRET must be set in production');
  }
  return val || 'dev-only-insecure-change-me-0000000000000000';
})(),