Description

This detector identifies hardcoded JWT secret keys in Dart applications using the Jaguar JWT library. Hardcoded secrets pose a critical security risk as they can be extracted from source code or compiled binaries, allowing attackers to forge valid JWT tokens and bypass authentication mechanisms.

Detection Strategy

• The detector only runs when the Jaguar JWT package (package:jaguar_jwt) is imported in the Dart file

• Test files are excluded from analysis to avoid false positives on test credentials

• The detector examines function calls that match known Jaguar JWT secret-related method signatures

• For each matching function call, it checks if the second argument (index 1) contains the JWT secret parameter

• A vulnerability is reported when the secret argument resolves to a hardcoded string literal rather than a variable, configuration value, or environment variable

• The detector specifically looks for direct string assignments or literal values passed as the secret parameter to JWT signing/verification functions

Vulnerable code example

import 'package:jaguar_jwt/jaguar_jwt.dart';

// VULNERABLE: Using hardcoded HMAC key in JWT operations
String issueToken() {
  final claimSet = JwtClaim(subject: 'user-1');
  return issueJwtHS256(claimSet, 's3cret_hs256_key'); // Hardcoded secret compromises security
}
...

✅ Secure code example

import 'package:jaguar_jwt/jaguar_jwt.dart';
import 'dart:io';

// SAFE: Using environment variable for HMAC key
String issueToken() {
  final claimSet = JwtClaim(subject: 'user-1');
  final secretKey = Platform.environment['JWT_SECRET_KEY'] ?? 
    throw Exception('JWT_SECRET_KEY environment variable not set');...