SH205: Weak or empty application secret

Severity: high · Category: secrets · Applies to: all projects

Why it matters

Session, JWT and encryption keys that are empty, short or well known let attackers forge sessions and tokens or decrypt data.

How to fix

Generate a random value of at least 32 characters (Laravel: php artisan key:generate).

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH205

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH205