[GH-ISSUE #28] Hardcoded Fallback Encryption Key #15

New issue

Closed

opened 2026-10-15 13:01:30 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 13:01:30 +00:00

Owner

Originally created by @salty2011 on GitHub (Jun 13, 2025).
Original GitHub issue: https://github.com/games-on-whales/wolfmanager/issues/28

Summary

The application contains a hardcoded fallback encryption key, which poses a critical security risk if the required ENCRYPTION_KEY environment variable is not set.

File

src/lib/crypto.ts:4

Issue

A hardcoded fallback encryption key ("your-fallback-encryption-key-min-32-chars!!") is used if the ENCRYPTION_KEY environment variable is missing.

Risk

If the environment variable is not properly configured, all encrypted data (e.g., Steam API keys, Steam IDs) will be encrypted using a publicly known key.

Impact

HIGH – Complete compromise of encrypted user data.

Mitigation

Remove the fallback key entirely.
Force the application to fail startup if the ENCRYPTION_KEY is not defined.

Proposed Fix

if (!process.env.ENCRYPTION_KEY) {
  throw new Error("ENCRYPTION_KEY environment variable must be set.");
}

Benefits of Fixing

Ensures strong and secret encryption key use at all times.
Prevents unauthorized decryption of sensitive user data.
Aligns with secure development practices.

Tags: security, encryption, environment-variable, high-risk, bug

Originally created by @salty2011 on GitHub (Jun 13, 2025). Original GitHub issue: https://github.com/games-on-whales/wolfmanager/issues/28 ### Summary The application contains a hardcoded fallback encryption key, which poses a critical security risk if the required `ENCRYPTION_KEY` environment variable is not set. ### File `src/lib/crypto.ts:4` ### Issue * A hardcoded fallback encryption key (`"your-fallback-encryption-key-min-32-chars!!"`) is used if the `ENCRYPTION_KEY` environment variable is missing. ### Risk * If the environment variable is not properly configured, all encrypted data (e.g., Steam API keys, Steam IDs) will be encrypted using a publicly known key. ### Impact **HIGH** – Complete compromise of encrypted user data. ### Mitigation * Remove the fallback key entirely. * Force the application to fail startup if the `ENCRYPTION_KEY` is not defined. ### Proposed Fix ```ts if (!process.env.ENCRYPTION_KEY) { throw new Error("ENCRYPTION_KEY environment variable must be set."); } ``` ### Benefits of Fixing * Ensures strong and secret encryption key use at all times. * Prevents unauthorized decryption of sensitive user data. * Aligns with secure development practices. **Tags:** `security`, `encryption`, `environment-variable`, `high-risk`, `bug`

bsakaguchi

2026-10-15 13:01:30 +00:00