Security: weak cryptography in src/cli/commands/setup.ts #1018

CodeRabbit's historical security scan of this repository (scan e8c825ec-84c1-4a90-b646-61791714baf8, revision bc22677aba, generated 2026-11-01) reported this. It is an AI-generated finding, not a confirmed vulnerability: reachability is not established by the scan, and the report itself says so. Triage before treating it as exploitable.

F-030 — weak cryptography (medium)

src/cli/commands/setup.ts:51-52

Setup rejects a recognized placeholder read from the environment file, but accepts that same value when inherited through process.env.SECRET. Because the supported package CLI preloads the file, setup can report success while retaining a predictable administrator-session signing secret.

Evidence

• Source/control: An existing .env containing the placeholder recognized by needsSecretReplacement, preloaded by the package CLI.
• Sink/decision: resolveSecret returns the inherited placeholder, which ensureEnvFile writes back without checking the replacement.
• Missing mitigation: The inherited replacement is not subject to the placeholder check applied to the file value. The final selected secret is also not checked before setup reports success.

Suggested fix. Apply the same placeholder rejection to every secret source, including process.env.SECRET. Generate a fresh random secret when the inherited value is a placeholder, and validate the final value before persisting it.

Finding F-030 of 43 in the scan. The other findings are filed as separate issues by area.