What would you do about leaked or compromised secrets?
Model answer
Rotate the secret immediately (database password, JWT secret, API keys), which for a JWT secret invalidates existing tokens. Remove it from the repository, noting that Git history still contains it, so rotation matters more than deleting. Check logs for misuse, and prevent a repeat with .env in .gitignore, secret scanning and a secrets manager.
Learn this topic
Login with JWT: Sign In, Issue a Token and Avoid Timing Leaks in the course MERN Stack Full Course: MongoDB, Express, React and Node.js.
Sign in to add your own answer.