GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
4797
Downloads
12.1M
Verified
4797
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2025-69971: Hardcoded Jwt Secretcve-2025-69971-hardcoded-jwt-secret

A hard-coded string literal is used as the secret/key parameter of jsonwebtoken `sign` or `verify`. Embedding the HMAC signing key in source code allows anyone with access to the repository or a shipped bundle to recover the key and forge tokens with arbitrary identity and group claims, leading to authentication bypass and privilege escalation (see CVE-2025-

JSNode.jsCVE-2025-69971GHSA-C8M8-3JCR-6RJ5CWE-321CWE-798
by Provallyupdated 2026-06-12Apache-2.0
3.6K0 direct3.6K via packs
86
All matching rules loaded.