The hacker attack my laravel project, what should i do.

i used jwt-auth in my laravel 7.0 project, but recently i found my project was attacked by hackers.

They scan my api interfaces and may crack my token secret , and now they can fake every user in my system.

i'm very confused why then can "stone" the token secret from my server, how can i found security breaches in my project, what should i do ?

please give your help.