Production password hardcoded in source

Code reviewSecurityMid–Senior~20 min

Review this Go service config loader.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 20 min

Mark a line and say what kind of problem it is.0 findings

1func loadConfig() Config {

2 secret := os.Getenv("JWT_SIGNING_SECRET")

3 if secret == "" {

4 secret = "s3cr3t-dev-key-please-change" // fallback for local/dev

5 }

6 return Config{

7 JWTSecret: secret,

8 DBPassword: "prod_db_p@ssw0rd_2024",

9 }

10}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.