CVE-2026-44523: Jwt Hmac Secret Missing Min Length Validationcve-2026-44523-jwt-hmac-secret-missing-min-length-validation
Struct field "$FIELD" holds a JWT/HMAC signing secret that is loaded from the environment without a minimum-length validation constraint. A decoded secret shorter than 32 bytes makes HS256 tokens brute-forceable offline (RFC 7518 §3.2 mandates ≥256-bit keys for HS256). Add `validate:"gte=32"` (or higher) to the struct tag so the application rejects an unders
