Hardcoded Postmark Server Token
About A07:2021 — Identification & Auth Failures
Authentication is hard to get right and easy to get subtly wrong. Common failures: storing passwords with weak hashes, not invalidating sessions on logout, allowing unlimited login attempts, accepting JWTs without verifying the signature. AI tools sometimes invent auth code that looks correct but skips the verification step.
Impact: When auth breaks, every user account is potentially compromised. Brute force on login becomes credential stuffing at scale. Session fixation lets one user steal another's session. Accepted-without-verification JWTs let anyone forge any identity.
How to fix it: Use a battle-tested auth provider (Clerk, Auth0, NextAuth, AWS Cognito) instead of building from scratch. If you must build it: bcrypt or argon2 for passwords, account lockout after N failed attempts, MFA support, signed and expiring session tokens, full JWT signature verification.
Common patterns in this category:
- JWT decoded without verifying the signature
- No account lockout after repeated failed logins
- Passwords hashed with MD5 or SHA-1 instead of bcrypt/argon2
- Session IDs that don't rotate on login or privilege change
- Password reset tokens that don't expire or aren't single-use
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
VC165 is part of the full 223-rule set on paid plans (from $19/mo)
The free, no-signup scan (paste code, upload a file, or npx xploitscan@latest scan .) runs 30 core rules.