diff --git a/config/index.js b/config/index.js
index c7640e194..e7442ea0b 100644
--- a/config/index.js
+++ b/config/index.js
@@ -135,6 +135,7 @@ const initGlobalConfig = async () => {
   configHelper.initSecureMode(config);
   // Print a warning if config.domain is not set
   if (process.env.NODE_ENV !== 'test') configHelper.validateDomainIsSet(config);
+  if (process.env.NODE_ENV !== 'test') configHelper.validateJwtSecret(config);
   // Expose configuration utilities
   const conf = { ...config };
   conf.utils = {
diff --git a/lib/helpers/config.js b/lib/helpers/config.js
index 2d3721d98..32f804218 100644
--- a/lib/helpers/config.js
+++ b/lib/helpers/config.js
@@ -54,6 +54,17 @@ const validateDomainIsSet = (config) => {
   }
 };
 
+/**
+ * @desc Warn if JWT secret is still set to the default placeholder value.
+ * @param {object} config - application configuration object
+ * @returns {void}
+ */
+const validateJwtSecret = (config) => {
+  if (config.jwt && config.jwt.secret === 'WaosSecretKeyExampleToChnageAbsolutely') {
+    console.log(chalk.red('+ Important warning: JWT secret is set to the default value. It should be changed in production via DEVKIT_NODE_jwt_secret.'));
+  }
+};
+
 /**
  * Validate secure parameters and create SSL credentials.
  * @param {object} config - application configuration object
@@ -106,6 +117,7 @@ const initGlobalConfigFiles = async (assets) => {
 export default {
   getGlobbedPaths,
   validateDomainIsSet,
+  validateJwtSecret,
   initSecureMode,
   initGlobalConfigFiles,
 };
diff --git a/modules/auth/controllers/auth.controller.js b/modules/auth/controllers/auth.controller.js
index c6ededc40..b00304ef8 100644
--- a/modules/auth/controllers/auth.controller.js
+++ b/modules/auth/controllers/auth.controller.js
@@ -322,6 +322,10 @@ const oauthCallback = async (req, res, next) => {
   const strategy = req.params.strategy;
   // app Auth with Strategy managed on client side
   if (req.body.strategy === false && req.body.key) {
+    const allowedKeys = ['id', 'sub', 'email'];
+    if (!allowedKeys.includes(req.body.key)) {
+      return responses.error(res, 422, 'Unprocessable Entity', 'Invalid provider key')();
+    }
     try {
       let user = {
         firstName: req.body.firstName,
diff --git a/modules/auth/controllers/auth.password.controller.js b/modules/auth/controllers/auth.password.controller.js
index 78f1daf7e..a64d2fdcb 100644
--- a/modules/auth/controllers/auth.password.controller.js
+++ b/modules/auth/controllers/auth.password.controller.js
@@ -27,9 +27,10 @@ const forgot = async (req, res) => {
   let user;
   // check input
   if (!req.body.email) return responses.error(res, 422, 'Unprocessable Entity', 'Mail field must not be blank')();
+  const email = String(req.body.email);
   // get user generate and add token
   try {
-    user = await UserService.getBrut({ email: req.body.email });
+    user = await UserService.getBrut({ email });
     if (!user) return responses.error(res, 400, 'Bad Request', 'No account with that email has been found')();
     if (user.provider !== 'local')
       return responses.error(res, 400, 'Bad Request', `It seems like you signed up using your ${user.provider} account`)();
@@ -68,7 +69,7 @@ const forgot = async (req, res) => {
  */
 const validateResetToken = async (req, res) => {
   try {
-    const user = await UserService.getBrut({ resetPasswordToken: req.params.token });
+    const user = await UserService.getBrut({ resetPasswordToken: String(req.params.token) });
     if (!user || !user.email) return res.redirect('/api/password/reset/invalid');
     res.redirect(`/api/password/reset/${req.params.token}`);
   } catch (_err) {
@@ -86,9 +87,10 @@ const reset = async (req, res) => {
   let user;
   // check input
   if (!req.body.token || !req.body.newPassword) return responses.error(res, 400, 'Bad Request', 'Password or Token fields must not be blank')();
+  const token = String(req.body.token);
   // get user by token, update with new password, login again
   try {
-    user = await UserService.getBrut({ resetPasswordToken: req.body.token });
+    user = await UserService.getBrut({ resetPasswordToken: token });
     if (!user || !user.email) return responses.error(res, 400, 'Bad Request', 'Password reset token is invalid or has expired.')();
     const edit = {
       password: await AuthService.hashPassword(req.body.newPassword),