Store the JWT signing secret outside source control: use the deployment platform's secret manager in production, and an uncommitted `.env` file supplied through the environment for local development. Never put it in frontend code, a checked-in config file, or a JWT payload. ```ts const jwtSecret = process.env.JWT_SECRET; if (!jwtSecret) { throw new Error("JWT_SECRET is not configured"); } ``` Load it once during startup, restrict access to the service, rotate it through the secret manager, an...
Scanned 9/5/2026
Install to Claude Code
Skills Directorynpx -y skills add HoangNguyen0403/agent-skills-standard --skill typescript-security --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Typescript Security?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-typescript-security-1f169981)More formats (shields.io, HTML) on the badges page.
Store the JWT signing secret outside source control: use the deployment platform's secret manager in production, and an uncommitted `.env` file supplied through the environment for local development. Never put it in frontend code, a checked-in config file, or a JWT payload.
```ts
const jwtSecret = process.env.JWT_SECRET;
if (!jwtSecret) {
throw new Error("JWT_SECRET is not configured");
}
```
Load it once during startup, restrict access to the service, rotate it through the secret manager, and use a key identifier/key rotation strategy when needed. Prefer an asymmetric `RS256`/`jose` setup for distributed verification; keep private keys in the secret manager and publish only the public key. Deliver browser tokens in `HttpOnly`, `Secure`, appropriately `SameSite` cookies and validate issuer, audience, expiry, and algorithm when verifying.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
