From 8901a0a5dbcba4bddf078a0a11dccfef3aa753e0 Mon Sep 17 00:00:00 2001
From: wrishach <wrisha.ch@gmail.com>
Date: Sun, 26 Jul 2026 17:12:47 -0400
Subject: [PATCH] Revert "Replace hardcoded JWT secret with environment
 variable"

---
 vuln-main-10.java | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/vuln-main-10.java b/vuln-main-10.java
index 58f55f77..acbd0592 100644
--- a/vuln-main-10.java
+++ b/vuln-main-10.java
@@ -11,8 +11,8 @@ public class App
 
     private static void bad1() {
         try {
-            String secretKey = System.getenv("JWT_SECRET");
-            Algorithm algorithm = Algorithm.HMAC256(secretKey);
+            // ruleid: java-jwt-hardcoded-secret
+            Algorithm algorithm = Algorithm.HMAC256("secret");
             String token = JWT.create()
                 .withIssuer("auth0")
                 .sign(algorithm);