From ee4b8c5b18e1885a492baf2721dffa8b8d044377 Mon Sep 17 00:00:00 2001
From: "semgrep.dev on behalf of @wrishach" <support@semgrep.com>
Date: Thu, 23 Jul 2026 17:22:15 +0000
Subject: [PATCH 1/4] Add Semgrep CI

---
 .github/workflows/semgrep.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/semgrep.yml

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 00000000..6227c4b0
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,26 @@
+on:
+  workflow_dispatch: {}
+  pull_request: {}
+  push:
+    branches:
+    - main
+    - master
+    paths:
+    - .github/workflows/semgrep.yml
+  schedule:
+  # random HH:MM to avoid a load spike on GitHub Actions at 00:00
+  - cron: 11 10 * * *
+name: Semgrep
+jobs:
+  semgrep:
+    name: semgrep/ci
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: semgrep/semgrep
+    steps:
+    - uses: actions/checkout@v6
+    - run: semgrep ci

From a27d9ca4104970778b426fcb8817c02877dd4040 Mon Sep 17 00:00:00 2001
From: "semgrep-code-wrishach[bot]"
 <308470310+semgrep-code-wrishach[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 17:52:59 +0000
Subject: [PATCH 2/4] Replace hardcoded JWT secret with environment variable

Replace hardcoded JWT secret in `bad1()` with a runtime environment variable lookup to prevent credential exposure in source code.

## Changes
- Replaced the hardcoded `"secret"` string literal passed to `Algorithm.HMAC256()` with `System.getenv("JWT_SECRET")`
- The JWT signing secret is now read from the `JWT_SECRET` environment variable at runtime

## Why
Hardcoding secrets in source code risks leaking credentials through version control, logs, or code sharing. Reading the secret from an environment variable keeps it out of the codebase and allows secure credential management through deployment configuration, vaults, or HSMs.

## Semgrep Finding Details
A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).

wrisha.ch@gmail.com requested this Autofix PR for [this finding](https://semgrep.dev/orgs/wrisha_semgrep_demo/findings/898638759) from the detection rule [java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret](https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret).
---
 vuln-main-10.java | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/vuln-main-10.java b/vuln-main-10.java
index acbd0592..58f55f77 100644
--- a/vuln-main-10.java
+++ b/vuln-main-10.java
@@ -11,8 +11,8 @@ public class App
 
     private static void bad1() {
         try {
-            // ruleid: java-jwt-hardcoded-secret
-            Algorithm algorithm = Algorithm.HMAC256("secret");
+            String secretKey = System.getenv("JWT_SECRET");
+            Algorithm algorithm = Algorithm.HMAC256(secretKey);
             String token = JWT.create()
                 .withIssuer("auth0")
                 .sign(algorithm);

From 8901a0a5dbcba4bddf078a0a11dccfef3aa753e0 Mon Sep 17 00:00:00 2001
From: wrishach <wrisha.ch@gmail.com>
Date: Sun, 26 Jul 2026 17:12:47 -0400
Subject: [PATCH 3/4] Revert "Replace hardcoded JWT secret with environment
 variable"

---
 vuln-main-10.java | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/vuln-main-10.java b/vuln-main-10.java
index 58f55f77..acbd0592 100644
--- a/vuln-main-10.java
+++ b/vuln-main-10.java
@@ -11,8 +11,8 @@ public class App
 
     private static void bad1() {
         try {
-            String secretKey = System.getenv("JWT_SECRET");
-            Algorithm algorithm = Algorithm.HMAC256(secretKey);
+            // ruleid: java-jwt-hardcoded-secret
+            Algorithm algorithm = Algorithm.HMAC256("secret");
             String token = JWT.create()
                 .withIssuer("auth0")
                 .sign(algorithm);

From 1d264d0dbfd00b63d97efaa2dd2f386952c1a73d Mon Sep 17 00:00:00 2001
From: wrishach <wrisha.ch@gmail.com>
Date: Tue, 4 Aug 2026 19:48:29 -0400
Subject: [PATCH 4/4] Add 'test' section to README

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index ac5b1110..68aba843 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,5 @@
 ## Setup
+test
 
 ### Requisites
 
@@ -51,4 +52,4 @@ Host: localhost:5000
 
 Cookie: api_key=myapisecret
 
-...
\ No newline at end of file
+...