From cf3dfba9f8a9c8512b200579cc095795a3a33495 Mon Sep 17 00:00:00 2001 From: AndersonDesign1 Date: Mon, 22 Jun 2026 16:15:28 +0100 Subject: [PATCH] fix(auth): remove dead secret fallback in email-log id salt MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit getEmailLogId reused `process.env.BETTER_AUTH_SECRET ?? ""`, which React Doctor flagged as a hardcoded secret that fails open. In production the module already throws when BETTER_AUTH_SECRET is unset, so the literal branch was unreachable there. Reuse the already-validated `rawAuthSecret` and give the dev-only path an explicitly named, non-secret salt — the value is a log-correlation HMAC salt, never a signing key. Clears the only React Doctor security error; full-project score 49 -> 87. Co-Authored-By: Claude Opus 4.8 --- src/auth/better-auth.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/auth/better-auth.ts b/src/auth/better-auth.ts index 4b3def7..c4f5a4c 100644 --- a/src/auth/better-auth.ts +++ b/src/auth/better-auth.ts @@ -44,7 +44,10 @@ function getTrustedOrigins() { } function getEmailLogId(email: string) { - const secret = process.env.BETTER_AUTH_SECRET ?? "clientra-auth-email-log"; + // Salt for a non-reversible log-correlation id (keeps raw emails out of logs). + // In production `rawAuthSecret` is guaranteed set (we throw above otherwise); + // the dev-only constant is an explicit, non-secret salt — never a real key. + const secret = rawAuthSecret ?? "clientra-dev-email-log-salt"; return createHmac("sha256", secret) .update(email.trim().toLowerCase())