The Spare Key Everyone Already Has

The scariest bugs are the ones that never error. This week’s did its job perfectly, which was the whole problem.

A .NET API I was hardening signs its login tokens with a secret key. If that key was missing from the environment, the code did the polite thing and fell back to a default so nothing would break. The default was a placeholder value that lives in the source, committed, readable by anyone who has ever opened the repo.

So anywhere but a developer’s laptop, if the real secret failed to load for any reason, the service would carry on and sign tokens with a key that is effectively public.

What that means in practice. It is a front door with a solid lock, and a spare hidden under the mat that the whole street already has a copy of. Anyone holding that public key could forge a token and walk in as any user. Nothing would look wrong. The logs would show a valid signature, because it was valid, just signed with the wrong key.

The fix is to refuse to start. Outside development, a missing or placeholder signing key is now a hard failure, not a shrug, and the service will not boot on the spare. I paired it with removing the demo accounts that shipped enabled, the other “so it works out of the box” convenience that quietly doubles as a way in.

This is the security background showing up as a reflex. Convenience defaults are the first place I look, because “so it just works” and “so anyone can get in” are often the same line of code.

Better to fail loudly at boot than run happily with the door propped open.