BotSharp’s Starter Ships a Hard-Coded Signing Key. Every Agent Built On It Inherits the Forgery Path.

The signing key for the framework’s login tokens sits in the starter template’s configuration file, in the repository, in plain text. This flaw, identified as CVE-2026-108860, represents a failure of trust-through-defaults at the…