Persist per-install JWT signing secret #3

Merged

Ghost merged 1 commits from blake/jwt-secret-persist into master

2026-08-31 18:57:55 -05:00

Author	SHA1	Message	Date
s1d3sw1ped_bot	22844a2a67	Persist a per-install JWT signing secret instead of a compiled-in default. Format / gofmt (push) Successful in 8s Details Format / gofmt (pull_request) Successful in 9s Details CI / Build (push) Successful in 24s Details CI / Build (pull_request) Successful in 25s Details CI / Go Tests (pull_request) Successful in 39s Details CI / Go Tests (push) Successful in 40s Details Admin tokens were forgeable whenever JWT_SECRET was unset. Prefer the env var, otherwise write a random key to data/.jwt_secret.	2026-08-31 23:55:34 +00:00