diff --git a/config.py b/config.py
index 17e65c5..5a88050 100644
--- a/config.py
+++ b/config.py
@@ -1,4 +1,5 @@
 import os
+import secrets
 import connexion
 from flask import jsonify
 from flask_sqlalchemy import SQLAlchemy
@@ -10,7 +11,11 @@
 vuln_app.app.config['SQLALCHEMY_DATABASE_URI'] = SQLALCHEMY_DATABASE_URI
 vuln_app.app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
 
-vuln_app.app.config['SECRET_KEY'] = 'random'
+# The JWT signing key must be a high-entropy secret - a short, guessable value like "random"
+# lets an attacker offline-brute-force it and forge arbitrary auth tokens (including for the
+# admin account). Falls back to a securely random 256-bit key generated at process start if the
+# deployment doesn't provide its own via the environment.
+vuln_app.app.config['SECRET_KEY'] = os.getenv('SECRET_KEY') or secrets.token_hex(32)
 # start the db
 db = SQLAlchemy(vuln_app.app)