Remove insecure JWT secret fallback to literal string 'secret'

[JSE19]

Description: Both hashToken() and issueJwt() in Sep10Service use this.configService.get('SEP10_JWT_SECRET') || 'secret' as fallback. If the env var is empty or unset at runtime, the JWT secret becomes the literal string 'secret'. An attacker who knows this can forge valid JWTs arbitrarily.
Acceptance Criteria:

• Remove the '|| 'secret' fallback from both hashToken() and issueJwt()
• Throw a Configuration error if SEP10_JWT_SECRET is missing at startup
• The Joi validation schema already requires min(32) for SEP10_JWT_SECRET
• Unit test verifies that empty secret throws instead of fallback

[samkay-ops]

@samkay-ops has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on issue #283 Remove insecure JWT secret fallback to literal string 'secret' because I have strong experience fixing security issues in JWT authentication flows. I will remove the || 'secret' fallback from hashToken() and issueJwt() in Sep10Service, throw a Configuration error if SEP10_JWT_SECRET is missing at startup, and update tests. This eliminates a critical security vulnerability. I can start immediately and deliver a secure fix. Ready to contribute!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @samkay-ops to this issue.

[ositaemmanuel653-netizen]

@ositaemmanuel653-netizen has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I’m a smart contract and full-stack developer who turns complex ideas into secure, production-ready blockchain code.
With strong skills in Rust and Solidity, I build systems that are fast, safe, and built to last.
My experience with the Stellar SDK lets me ship real-world Web3 solutions that actually move value

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ositaemmanuel653-netizen to this issue.

[0takuc0mrade]

@0takuc0mrade has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi, I’d like to work on issue #283.

I can remove the insecure JWT secret fallback from hashToken() and issueJwt(), ensure SEP10_JWT_SECRET fails fast with a configuration error when missing, and add a unit test confirming an empty secret throws instead of falling back to "secret".

This is a small but important security fix, and I can keep the change focused.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @0takuc0mrade to this issue.

[Ainulhareery]

@Ainulhareery has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello, this issue aligns well with my skill set and I’m confident I can resolve it properly. Please assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ainulhareery to this issue.

[Ryjen1]

@Ryjen1 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ryjen1 to this issue.

[Mendes472]

@Mendes472 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Can i work on this?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Mendes472 to this issue.

[IbrahimIjai]

@IbrahimIjai has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Can I work on this...?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @IbrahimIjai to this issue.

[drips-wave]

Congratulations, @IbrahimIjai! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @IbrahimIjai: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊