From 4e8682e53b4d4a6cc45ede9ff4b1e9f8f785b8e7 Mon Sep 17 00:00:00 2001 From: "Adrian A. Baumann" Date: Mon, 13 Jul 2026 13:25:32 +0200 Subject: [PATCH] Use env var with random fallback for SECRET_KEY instead of committed literal --- labhelper/settings.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/labhelper/settings.py b/labhelper/settings.py index d2d7562..b3e8306 100644 --- a/labhelper/settings.py +++ b/labhelper/settings.py @@ -14,6 +14,8 @@ import os import re from pathlib import Path +from django.core.management.utils import get_random_secret_key + # Build paths inside the project like this: BASE_DIR / 'subdir'. BASE_DIR = Path(__file__).resolve().parent.parent @@ -22,10 +24,10 @@ BASE_DIR = Path(__file__).resolve().parent.parent # See https://docs.djangoproject.com/en/5.2/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = os.environ.get( - "DJANGO_SECRET_KEY", - "f0arjg8q3ut4iuqrguqfjaruf0eripIZZN3t1kymy8ugqnj$li2knhha0@gc5v8f3bge=$+gbybj2$jt28uqm", -) +# Production supplies DJANGO_SECRET_KEY via the Kubernetes secret. If it is unset +# (local dev), fall back to an ephemeral random key rather than a committed literal; +# sessions won't survive a restart, which is fine for development. +SECRET_KEY = os.environ.get("DJANGO_SECRET_KEY") or get_random_secret_key() # SECURITY WARNING: don't run with debug turned on in production! DEBUG = os.environ.get("DEBUG", "True").lower() == "true"