Hardcoded Cryptographic Keys and Salts

// Java - SECURE: Environment-based key management
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.security.SecureRandom;
import java.util.Base64;

public class SecureDataEncryption {
    private final SecretKeySpec keySpec;
    private final SecureRandom secureRandom;
    
    public SecureDataEncryption() {
        // Load key from environment variable
        String keyString = System.getenv("AES_ENCRYPTION_KEY");
        if (keyString == null || keyString.length() != 32) {
            throw new IllegalStateException("AES_ENCRYPTION_KEY environment variable must be 32 characters");
        }
        
        this.keySpec = new SecretKeySpec(keyString.getBytes(), "AES");
        this.secureRandom = new SecureRandom();
    }
    
    public EncryptionResult encryptData(String plaintext) throws Exception {
        // Generate random IV for each encryption
        byte[] iv = new byte[16];
        secureRandom.nextBytes(iv);
        
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, keySpec, new IvParameterSpec(iv));
        
        byte[] encrypted = cipher.doFinal(plaintext.getBytes());
        
        return new EncryptionResult(encrypted, iv);
    }
    
    public static class EncryptionResult {
        public final byte[] ciphertext;
        public final byte[] iv;
        
        public EncryptionResult(byte[] ciphertext, byte[] iv) {
            this.ciphertext = ciphertext;
            this.iv = iv;
        }
    }
}

// Python - SECURE: Using AWS Secrets Manager
import boto3
import json
import os
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.backends import default_backend
from cryptography.fernet import Fernet
import secrets

class SecureCryptoManager:
    def __init__(self):
        self.secrets_client = boto3.client('secretsmanager')
        self.cache = {}  # Simple cache for secrets (implement TTL in production)
    
    def get_secret(self, secret_name):
        """Retrieve secret from AWS Secrets Manager with caching"""
        if secret_name in self.cache:
            return self.cache[secret_name]
        
        try:
            response = self.secrets_client.get_secret_value(SecretId=secret_name)
            secret_value = json.loads(response['SecretString'])
            self.cache[secret_name] = secret_value
            return secret_value
        except Exception as e:
            raise Exception(f"Failed to retrieve secret {secret_name}: {str(e)}")
    
    def generate_random_salt(self, length=32):
        """Generate cryptographically secure random salt"""
        return secrets.token_bytes(length)
    
    def hash_password(self, password, salt=None):
        """Hash password with random salt using PBKDF2"""
        if salt is None:
            salt = self.generate_random_salt()
        
        # Get key derivation parameters from secrets manager
        kdf_config = self.get_secret('password-hashing-config')
        
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            iterations=kdf_config['iterations'],  # e.g., 100000
            backend=default_backend()
        )
        
        key = kdf.derive(password.encode())
        return {
            'hash': key,
            'salt': salt,
            'iterations': kdf_config['iterations']
        }
    
    def get_encryption_key(self, key_name):
        """Get encryption key from secrets manager"""
        secret = self.get_secret(f'encryption-keys/{key_name}')
        return secret['key'].encode()
    
    def encrypt_data(self, data, key_name):
        """Encrypt data using key from secrets manager"""
        key = self.get_encryption_key(key_name)
        f = Fernet(key)
        return f.encrypt(data.encode())
    
    def decrypt_data(self, encrypted_data, key_name):
        """Decrypt data using key from secrets manager"""
        key = self.get_encryption_key(key_name)
        f = Fernet(key)
        return f.decrypt(encrypted_data).decode()

// Node.js - SECURE: Proper JWT secret management
const jwt = require('jsonwebtoken');
const crypto = require('crypto');
const fs = require('fs');

class SecureAuthService {
    constructor() {
        this.validateEnvironment();
        this.loadKeys();
    }
    
    validateEnvironment() {
        const requiredEnvVars = [
            'JWT_PRIVATE_KEY_PATH',
            'JWT_PUBLIC_KEY_PATH',
            'JWT_KEY_ID',
            'JWT_ISSUER'
        ];
        
        const missing = requiredEnvVars.filter(env => !process.env[env]);
        if (missing.length > 0) {
            throw new Error(`Missing environment variables: ${missing.join(', ')}`);
        }
    }
    
    loadKeys() {
        try {
            // Use asymmetric keys (RS256) for better security
            this.privateKey = fs.readFileSync(process.env.JWT_PRIVATE_KEY_PATH, 'utf8');
            this.publicKey = fs.readFileSync(process.env.JWT_PUBLIC_KEY_PATH, 'utf8');
            this.keyId = process.env.JWT_KEY_ID;
            this.issuer = process.env.JWT_ISSUER;
        } catch (error) {
            throw new Error(`Failed to load JWT keys: ${error.message}`);
        }
    }
    
    generateToken(userId, role, expiresIn = '1h') {
        const payload = {
            sub: userId,
            role: role,
            iss: this.issuer,
            aud: process.env.JWT_AUDIENCE || 'api',
            jti: this.generateJti() // Unique token ID
        };
        
        const options = {
            algorithm: 'RS256',
            expiresIn: expiresIn,
            keyid: this.keyId,
            issuer: this.issuer
        };
        
        return jwt.sign(payload, this.privateKey, options);
    }
    
    verifyToken(token) {
        const options = {
            algorithms: ['RS256'],
            issuer: this.issuer,
            audience: process.env.JWT_AUDIENCE || 'api'
        };
        
        try {
            return jwt.verify(token, this.publicKey, options);
        } catch (error) {
            throw new Error(`Token verification failed: ${error.message}`);
        }
    }
    
    generateJti() {
        // Generate unique token identifier
        return crypto.randomBytes(16).toString('hex');
    }
    
    // Key rotation support
    rotateKeys() {
        // Implement key rotation logic
        // 1. Generate new key pair
        // 2. Update key storage
        // 3. Gradually phase out old keys
        console.log('Key rotation should be handled by your secret management system');
    }
}

# application.yml - SECURE: Using environment variable placeholders
spring:
  datasource:
    url: ${DATABASE_URL}
    username: ${DATABASE_USERNAME}
    password: ${DATABASE_PASSWORD}
    
app:
  security:
    jwt:
      # Reference to external key management
      private-key-path: ${JWT_PRIVATE_KEY_PATH}
      public-key-path: ${JWT_PUBLIC_KEY_PATH}
      key-id: ${JWT_KEY_ID}
      issuer: ${JWT_ISSUER}
    
    encryption:
      # Keys managed externally
      key-management-service: ${KEY_MANAGEMENT_SERVICE_URL}
      key-namespace: ${ENCRYPTION_KEY_NAMESPACE}
      
    external:
      # API keys from environment or secret manager
      stripe-secret: ${STRIPE_SECRET_KEY}
      sendgrid-api-key: ${SENDGRID_API_KEY}
      
ssl:
  key-store-path: ${SSL_KEYSTORE_PATH}
  key-store-password: ${SSL_KEYSTORE_PASSWORD}
  trust-store-path: ${SSL_TRUSTSTORE_PATH}
  trust-store-password: ${SSL_TRUSTSTORE_PASSWORD}

---
# Java Configuration Class - SECURE
@Configuration
@Validated
public class SecurityConfig {
    
    @Value("${app.security.jwt.private-key-path}")
    @NotBlank
    private String jwtPrivateKeyPath;
    
    @Value("${app.security.jwt.public-key-path}")
    @NotBlank
    private String jwtPublicKeyPath;
    
    @Value("${app.security.encryption.key-management-service}")
    @NotBlank
    private String keyManagementServiceUrl;
    
    @PostConstruct
    public void validateConfiguration() {
        // Validate that all required files exist
        if (!Files.exists(Paths.get(jwtPrivateKeyPath))) {
            throw new IllegalStateException("JWT private key file not found: " + jwtPrivateKeyPath);
        }
        
        if (!Files.exists(Paths.get(jwtPublicKeyPath))) {
            throw new IllegalStateException("JWT public key file not found: " + jwtPublicKeyPath);
        }
    }
}