api-security-hardening

The code is a security-oriented FastAPI example and contains no evident malware or intentional data exfiltration. It has material security weaknesses: hardcoded JWT and API-key secrets, commented-out password hashing, and API keys returned without persistence or lifecycle controls. Secrets should come from protected configuration or a secret manager, passwords must be hashed before storage, and API keys require secure storage, expiration enforcement, revocation, and access controls.