Context: The `xmcloud.build.json` file ships with an identical `jssDeploymentSecret` value across all 7 rendering hosts. This is a known-value secret in a public GitHub template. The CVE-2025-53690 incident (Sitecore ViewState deserialization zero-day exploited via default machine keys) demonstrates that default secrets in public templates are actively targeted by threat actors. While developers are expected to rotate this value, there is no guardrail preventing deployment with the default.
Steps:
1. Add a prominent warning in the root README under the Local Development Setup section: "WARNING: Rotate `jssDeploymentSecret` in `xmcloud.build.json` before deploying to any non-local environment."
2. Add inline comments in `xmcloud.build.json` above each `jssDeploymentSecret` entry.
3. Consider adding a CI check in the DMZ validation workflow that fails if the default secret value `110F1C44A496B45478640DD36F80C18C9` is detected (with an override for the template repo itself).
Acceptance criteria:
README contains a visible warning about rotating the deployment secret
`xmcloud.build.json` has inline documentation about the secret
Optional: CI check validates secret rotation
Risks: None identified. This is a documentation and guardrail improvement.