[kit-layout][Audit 2026-04-14] Security configuration risks in default setup

[yanghao1143]

Summary

go-saas/kit-layout issues are disabled; tracking this audit item in go-saas/kit.

Findings (kit-layout)

• Critical | confirmed hard-coded JWT secret and security cookie hash.
  • Evidence: kit-layout/configs/config.yaml:41, :43
• High | probable permissive CORS wildcard.
  • Evidence: kit-layout/configs/config.yaml:7
• Medium | confirmed container runs as root.
  • Evidence: kit-layout/Dockerfile:8, :24

Suggested Direction

• Externalize/rotate secrets.
• Restrict CORS per environment.
• Run as non-root user.