From 72335f18d36d77c9765be626aa310837354ec2be Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 6 Sep 2026 10:48:30 +0000
Subject: [PATCH] security: enforce environment variable for HMAC secret key

Replaces hardcoded HMAC secret key used in webhook payload signing with process.env.IDSEC_SECRET_SALT and throws an error if missing in production.

Co-authored-by: Pmaster-dev <293764797+Pmaster-dev@users.noreply.github.com>
---
 server/routes.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/server/routes.ts b/server/routes.ts
index d10cf6b..5ece491 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -2453,7 +2453,12 @@ CSAF: ${baseUrl}/.well-known/csaf/provider-metadata.json
       // Create webhook payload with cryptographic signature
       const payloadId = uuidv4();
       const payloadString = JSON.stringify(data);
-      const signature = crypto.createHmac("sha256", "idsec_secret_salt").update(payloadString).digest("hex");
+      // Security: Require environment variable for HMAC secret key in production to prevent static key exposure
+      const secretSalt = process.env.IDSEC_SECRET_SALT;
+      if (!secretSalt && process.env.NODE_ENV === "production") {
+        throw new Error("IDSEC_SECRET_SALT environment variable is required in production");
+      }
+      const signature = crypto.createHmac("sha256", secretSalt || "development_idsec_secret_salt").update(payloadString).digest("hex");
       
       const payload = {
         id: payloadId,