diff --git a/backend/src/utils/jwt.ts b/backend/src/utils/jwt.ts
index 551da13..d2dffef 100644
--- a/backend/src/utils/jwt.ts
+++ b/backend/src/utils/jwt.ts
@@ -3,7 +3,13 @@ import { IUser } from '../models/User';
 
 import type { SignOptions } from 'jsonwebtoken';
 
-const JWT_SECRET = process.env.JWT_SECRET || 'dev_secret_key';
+const JWT_SECRET = process.env.JWT_SECRET;
+if (!JWT_SECRET || JWT_SECRET.length < 32 || JWT_SECRET === 'change_me_in_production' || JWT_SECRET === 'dev_secret_key') {
+  throw new Error(
+    'JWT_SECRET must be set to a strong value (min 32 chars). Generate one with: openssl rand -base64 32'
+  );
+}
+
 const JWT_EXPIRES_IN = (process.env.JWT_EXPIRES_IN || '7d') as SignOptions['expiresIn'];
 const JWT_REFRESH_EXPIRES_IN = (process.env.JWT_REFRESH_EXPIRES_IN || '30d') as SignOptions['expiresIn'];