diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..a234dd9
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,6 @@
+# Sentinel Security Journal
+
+## 2026-09-03 - Configurable HMAC Salt for Webhook Signatures
+**Vulnerability:** Hardcoded secret salt `"idsec_secret_salt"` used in `server/routes.ts` for HMAC webhook payload signing.
+**Learning:** Hardcoded cryptographic keys in API routes leak secrets in open source code and enable payload signature forgery.
+**Prevention:** Always pull HMAC secret salts from environment variables (`IDSEC_SECRET_SALT` / `WEBHOOK_SECRET`) with non-production development fallbacks.
diff --git a/server/routes.ts b/server/routes.ts
index d10cf6b..7d43f4d 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -2453,7 +2453,9 @@ CSAF: ${baseUrl}/.well-known/csaf/provider-metadata.json
       // Create webhook payload with cryptographic signature
       const payloadId = uuidv4();
       const payloadString = JSON.stringify(data);
-      const signature = crypto.createHmac("sha256", "idsec_secret_salt").update(payloadString).digest("hex");
+      // Security: Avoid hardcoded secrets in production. Use environment variables with safe dev fallback.
+      const secretSalt = process.env.IDSEC_SECRET_SALT || process.env.WEBHOOK_SECRET || "negrarosa_dev_webhook_secret_salt";
+      const signature = crypto.createHmac("sha256", secretSalt).update(payloadString).digest("hex");
       
       const payload = {
         id: payloadId,