You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Sep 8, 2026. It is now read-only.
Repository navigation
This repository was archived by the owner on Sep 8, 2026. It is now read-only.
.env.mainnet and .env.sepolia ship a shared default BASE_NODE_L2_ENGINE_AUTH_RAW with no fail-fast guard #1159
Both .env.mainnet and .env.sepolia commit the same hardcoded value for BASE_NODE_L2_ENGINE_AUTH_RAW — byte-identical across the two files and present since the env files were first added. This is a secret that is meant to be unique per deployment, but it ships as a working default. Current behaviour: consensus-entrypoint and execution-entrypoint check only that the variable is non-empty, then use it as-is; because the committed default is non-empty, a deployment that never overrides it starts successfully and runs on the shared default with no warning or error. A safe default would ship a placeholder rather than a usable value, and the entrypoints would fail fast when the placeholder is still in place, so that running on an unconfigured secret is impossible rather than silent. Affected files: .env.mainnet, .env.sepolia, consensus-entrypoint, execution-entrypoint.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
Activity
fix: fail fast when Engine API JWT secret is left at shared default
github-actions commentedon Aug 29, 2026
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
erhnysr commentedon Aug 29, 2026
Still relevant — the shared hardcoded default with no fail-fast guard remains a real gap. Linked PR #1160 is ready for review.