This is one of the dumbest web challenges that I have done, it is so simple that I can't even write all that much on it. It is one of those things that you don't tend to manually test anymore simply because of how unlikely it is nowadays to find.

All you need to do, is go to the website, view source and look for the SECRET_KEY. It is truly an open secret ;)

#Website

#Flag

|<script>|
|// JWT Secret Key|
|const SECRET_KEY = "HTB{0p3n_s3cr3ts_ar3_n0t_s3cr3ts}";|