security: use explicit INSECURE_DEV_ONLY secret naming and add warning callouts

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

apps/studio/src/mocks/createKernel.ts

@@ -44,8 +44,9 @@ export async function createKernel(options: KernelOptions) {
     console.log('[KernelFactory] Protocol service will be registered by ObjectQLPlugin');
 
     // Register AuthPlugin for MSW/mock mode (gracefully skips HTTP route registration)
+    // WARNING: This secret is for local development only — never use in production
     await kernel.use(new AuthPlugin({
-        secret: 'mock-dev-secret-at-least-32-characters-long',
+        secret: 'INSECURE_DEV_ONLY_mock_secret_do_not_use_in_production',
         baseUrl: 'http://localhost:5173',
     }));
 

content/docs/guides/authentication.mdx

@@ -615,13 +615,15 @@ await kernel.use(new DriverPlugin(new InMemoryDriver(), 'memory'));
 
 // AuthPlugin works without HonoServerPlugin — no HTTP server needed
 await kernel.use(new AuthPlugin({
-  secret: 'mock-dev-secret-at-least-32-characters-long',
+  secret: 'INSECURE_DEV_ONLY_mock_secret_do_not_use_in_production',
   baseUrl: 'http://localhost:5173',
 }));
 
 await kernel.bootstrap();
 ```
 
+> ⚠️ **Warning:** The secret above is for **local development only**. In production, always use a strong random secret from an environment variable (`process.env.AUTH_SECRET`).
+
 ### Mock Fallback Endpoints
 
 When no auth service handler or broker is available, `HttpDispatcher.handleAuth()` automatically provides mock responses for:
@@ -643,8 +645,9 @@ The Studio app's `createKernel()` factory includes AuthPlugin by default:
 
 ```typescript
 // apps/studio/src/mocks/createKernel.ts
+// WARNING: This secret is for local development only
 await kernel.use(new AuthPlugin({
-  secret: 'mock-dev-secret-at-least-32-characters-long',
+  secret: 'INSECURE_DEV_ONLY_mock_secret_do_not_use_in_production',
   baseUrl: 'http://localhost:5173',
 }));
 ```