JWT token

[yemijaiyeola]

What's the deal with default? Authentication review needed

[kingdomlevel]

Apologies for the very late reply on here:

• The JWT token was generated specifically for us whenever the project was created
• We have committed that token (initial commit), so we should likely change it
• I tried changing my local .env file to a random 32 char string and it worked the same - so presumably we could do this and it would be an easy change
• the worry of publicly exposing the JWT token is that someone could use this (publicly available on github) token to spoof authenticated requests: https://strapi.io/documentation/developer-docs/latest/guides/jwt-validation.html