security: require JWT_SECRET environment variable

BREAKING CHANGE: Server now fails to start if JWT_SECRET is not set.
Previously fell back to insecure default "secret" which could allow
JWT forgery attacks on misconfigured deployments.

- Make JWT_SECRET required in config.rs with helpful error message
- Update Makefile and CI workflows to set test secret
- Update documentation to indicate JWT_SECRET is required

Author: adrgs

.github/workflows/pull-request-checks.yml

@@ -11,6 +11,8 @@ jobs:
     defaults:
       run:
         working-directory: src
+    env:
+      JWT_SECRET: test_secret_for_ci
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/quality-checks.yml

@@ -17,6 +17,8 @@ jobs:
     defaults:
       run:
         working-directory: src
+    env:
+      JWT_SECRET: test_secret_for_ci
     steps:
       - uses: actions/checkout@v4
 

CLAUDE.md

@@ -267,7 +267,7 @@ interface Request {
 
 | Variable | Description |
 |----------|-------------|
-| `JWT_SECRET` | Secret key for JWT signing (min 32 chars recommended) |
+| `JWT_SECRET` | **Required.** Secret key for JWT signing (min 32 chars recommended). Server will fail to start if not set. |
 | `DOMAIN` | Base domain (e.g., `requestrepo.com`) |
 | `SERVER_IP` | Public IP for DNS responses |
 

Makefile

@@ -66,7 +66,7 @@ test: test-backend test-frontend
 
 .PHONY: test-backend
 test-backend:
-	cd $(RUST_DIR) && cargo test
+	cd $(RUST_DIR) && JWT_SECRET=test_secret_for_ci cargo test
 
 .PHONY: test-frontend
 test-frontend:

src/src/utils/config.rs

@@ -61,7 +61,10 @@ impl Config {
         let subdomain_alphabet = env::var("SUBDOMAIN_ALPHABET")
             .unwrap_or_else(|_| "0123456789abcdefghijklmnopqrstuvwxyz".to_string());
         let subdomain_alphabet_set = subdomain_alphabet.chars().collect();
-        let jwt_secret = env::var("JWT_SECRET").unwrap_or_else(|_| "secret".to_string());
+        let jwt_secret = env::var("JWT_SECRET").expect(
+            "JWT_SECRET environment variable is required. \
+             Generate a secure random string (32+ chars) and set it before starting the server.",
+        );
         let txt_record = env::var("TXT").unwrap_or_else(|_| "Hello!".to_string());
         let http_port = env::var("HTTP_PORT")
             .unwrap_or_else(|_| "21337".to_string())