[LinuxDevil]

Fixes audit finding SEC-10 (Vercel competitor audit, 2026-10-19).

What was wrong

docs/auth.md showed jwt({ secret: process.env.JWT_SECRET ?? 'a-development-secret-of-32-bytes!!' }) (plus ?? 'ci-token', ?? 'change-me'). Copy-pasted to production, an unset env var silently used a public secret.

What changed

• The auth.md examples read secrets through a small requireEnv() that throws at startup when unset; basic() examples use process.env.X! / no fallback. The top snippet is marked no-run (it now needs env vars).
• Regenerated llms.txt / llms-full.txt.
• No helper change: jwt() already throws LOUSHO_AUTH_CONFIG_INVALID for an undefined or short secret and apiToken('') throws too; added test cases for secret: undefined and secret: ''.
• Other docs' ?? '' placeholders (channels, triggers) are empty strings, not usable secrets, and were left alone.

Tests

jwt.test.ts invalid-config table gains undefined and '' secrets (pass). Ran: tsc --noEmit, typecheck:tests, lint, docs:llms:check, verify-docs-snippets --source-only (333 snippets OK). grep for development-secret / ?? 'ci-token' / ?? 'change-me' in docs, README, examples, llms files is empty.

Changelog: Docs: auth examples no longer fall back to a hardcoded JWT secret when the env var is unset.

🤖 Generated with Claude Code