diff --git a/config.py b/config.py
index 17e65c5..5f807d8 100644
--- a/config.py
+++ b/config.py
@@ -1,4 +1,5 @@
 import os
+import secrets
 import connexion
 from flask import jsonify
 from flask_sqlalchemy import SQLAlchemy
@@ -10,7 +11,12 @@
 vuln_app.app.config['SQLALCHEMY_DATABASE_URI'] = SQLALCHEMY_DATABASE_URI
 vuln_app.app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
 
-vuln_app.app.config['SECRET_KEY'] = 'random'
+# JWT signing key must never be a fixed literal shipped in source: a hardcoded key lets
+# anyone forge auth tokens offline for any user (including admin) without ever logging in.
+# Prefer an operator-supplied secret (e.g. injected via environment/secret manager); fall
+# back to a securely-generated random key per process so there is no shared, guessable
+# default even when no override is configured.
+vuln_app.app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY') or secrets.token_hex(32)
 # start the db
 db = SQLAlchemy(vuln_app.app)