PT-2026-30318

Summary: The file lightrag/api/config.py line 397 uses a default JWT secret "lightrag-jwt-default-secret" when the TOKEN SECRET environment variable is not set. The AuthHandler in lightrag/api/auth.py lines 24-25 uses this secret to sign and verify tokens. An unauthenticated attacker can forge...