🛡️ Sentinel: [CRITICAL] Fix hardcoded 2FA backdoor and NextAuth secrets

[secrooq]

🚨 Severity: CRITICAL

💡 Vulnerability

Found a hardcoded 2FA admin recovery bypass secret (stealth_dev_bypass_root_2026) and default fallback NextAuth secrets (stealth_relay_nextauth_secret_key_edge_v1_2026) in src/auth.ts and src/middleware.ts.

🎯 Impact

Hardcoding default secrets in production code as fallbacks completely negates the security provided by environment variables. The hardcoded backdoor allowed trivial authentication bypass if the ADMIN_BYPASS_SECRET environment variable was missing or misconfigured, which could lead to unauthorized administrative access. Similarly, defaulting AUTH_SECRET ensures the app silently runs with a known, weak secret instead of securely failing when unconfigured.

🔧 Fix

• Removed the hardcoded stealth_dev_bypass_root_2026 2FA bypass backdoor in src/auth.ts.
• Implemented explicit fail-closed logic requiring the ADMIN_BYPASS_SECRET environment variable for 2FA bypass to work.
• Removed hardcoded default AUTH_SECRET fallbacks in src/auth.ts and src/middleware.ts to ensure NextAuth fails securely if unconfigured.
• Added a Sentinel journal entry documenting the learning and prevention strategy.

✅ Verification

• cat src/auth.ts and cat src/middleware.ts to verify the hardcoded strings are removed.
• npx tsc --noEmit, pnpm run build, pnpm test, and npx playwright test all run successfully.

---

PR created automatically by Jules for task 1779744050614316452 started by @secrooq

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.