fix: security hardening + bearer token auth for SDK

[0xSolace]

Summary

Security hardening pass plus critical auth fix for the SDK client.

Security Fixes

1. Separate JWT secret from master password — New STEWARD_JWT_SECRET env var. Falls back to master password with warning if not set.

2. Bind to localhost by default — Steward now binds to 127.0.0.1 instead of 0.0.0.0. Configurable via STEWARD_BIND_HOST.

3. Request body size limit — 1MB limit via Hono middleware to prevent memory exhaustion.

4. Request correlation IDs — Every request gets a X-Request-Id UUID, returned in response headers and included in logs.

SDK Auth Fix (Critical)

5. Bearer token auth for agent-scoped JWTs — StewardClient now accepts a bearerToken config option that sends Authorization: Bearer <token> instead of X-Steward-Key. This enables agent containers to authenticate with their JWT tokens.

   Previously, the SDK only supported tenant API key auth (X-Steward-Key), but production agents use JWT tokens. This mismatch caused all containers to silently fall back to local signing.

Environment Variables

Variable	Default	Description
STEWARD_JWT_SECRET	(master password)	Separate secret for JWT signing
STEWARD_BIND_HOST	127.0.0.1	Bind address for the API server

Testing

• 62 pass, 4 fail (pre-existing integration tests needing DATABASE_URL)
• All vault, policy engine, and plugin tests pass

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
steward-fi	Error		Mar 22, 2026 6:02pm