process.env.SECRET || 'default' is a security hole

A fallback secret looks like this:

const secret = process.env.JWT_SECRET || 'dev-secret';

In local development, it is convenient — no .env file required to get the app running. The problem is that this exact line ships to production, and if the real environment variable is ever missing — a misconfigured deploy, a renamed variable, a typo in the hosting dashboard — the app silently uses 'dev-secret' instead of crashing.

Why this is critical, not minor

If that fallback string appears anywhere in a public or semi-public repository — and it usually does, because it was written inline — it is no longer a secret. Every JWT signed with it can be forged by anyone who read the source. Every webhook validated against it can be spoofed. The “fallback” is not a safety net; it is a skeleton key that activates exactly when things go wrong.

Why AI tools generate this pattern so often

AI coding tools are trained on public code that includes thousands of tutorials and starter templates where || 'dev-secret' is the norm. When a model scaffolds JWT signing, webhook validation, or session configuration, it reproduces what it has seen most — not what is safest in production. The pattern looks defensive (it prevents a startup crash), which is part of why it passes code review even when it should not.

How to find every instance

Search your codebase for the pattern:

# Node.js / TypeScript
grep -rn "process\.env\.[A-Z_]\+ ||" .
grep -rn "process\.env\.[A-Z_]\+ ??" .

# Python
grep -rn "os.environ.get(" .    # second argument is a default
grep -rn "os.getenv(" .         # second argument is a default

Focus on anything used for signing, verification, or encryption: JWT secrets, webhook signing keys, session secrets, encryption keys, and API token validation.

The fix

// DANGEROUS: falls back to a public value if the env var is missing
const secret = process.env.JWT_SECRET || 'dev-secret-change-me';

// CORRECT: fail loudly at startup — a crashed deploy is immediately visible
const secret = process.env.JWT_SECRET;
if (!secret) throw new Error('JWT_SECRET environment variable is required');

A crashed deploy is visible in seconds and takes minutes to fix. A silently-running app with a public fallback secret can sit exposed for months. The same pattern applies to Python:

# DANGEROUS
secret = os.environ.get("JWT_SECRET", "dev-secret")

# CORRECT
secret = os.environ["JWT_SECRET"]  # KeyError at startup if missing

Related: if your JWT secret is hardcoded without any fallback, see hardcoded JWT secret. The broader context for where secrets belong is in what is an environment variable.

Common questions