rbrooks/WeatherBot

Watch

Fork 0

Reject placeholder SECRET_KEY in all environments (it currently passes production validation) #45

New issue

Closed

opened 2026-07-18 05:31:12 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-07-18 05:31:12 +00:00

Contributor

.env.example ships SECRET_KEY=changeme_generate_with_openssl_rand_hex_32.
That value is 43 chars and not in weak_secret_values
(app/config.py:112-126), so it passes validate_runtime() even under
APP_ENV=production. Session cookies (auth: session["user_id"]/role) are
signed with it, and app/services/ai_secrets.py:11-14 derives the Fernet key
for stored AI provider keys from it. A deployment keeping the example value
runs with a publicly-known signing key.

Fix:

Add the exact placeholder and a changeme prefix match to the rejected set,
enforced in every environment (fail closed at startup).
Ship .env.example with empty SECRET_KEY= and a generation comment; in
development, if unset, generate an ephemeral key and log a prominent warning.
Consider decoupling the Fernet key (derive with a distinct salt/info string)
so future SECRET_KEY rotation has a defined re-encryption path.

Acceptance criteria:

App refuses to start with the placeholder key in any APP_ENV
Dev with unset key runs with ephemeral key + warning
.env.example no longer contains a usable literal key
Config tests cover placeholder rejection

Filed from the 2026-07-17 codebase audit (docs/.internal/report-2026-07-17.md), finding F-06.

`.env.example` ships `SECRET_KEY=changeme_generate_with_openssl_rand_hex_32`. That value is 43 chars and not in `weak_secret_values` (app/config.py:112-126), so it passes `validate_runtime()` even under `APP_ENV=production`. Session cookies (auth: `session["user_id"]`/role) are signed with it, and `app/services/ai_secrets.py:11-14` derives the Fernet key for stored AI provider keys from it. A deployment keeping the example value runs with a publicly-known signing key. Fix: - Add the exact placeholder and a `changeme` prefix match to the rejected set, enforced in every environment (fail closed at startup). - Ship `.env.example` with empty `SECRET_KEY=` and a generation comment; in development, if unset, generate an ephemeral key and log a prominent warning. - Consider decoupling the Fernet key (derive with a distinct salt/info string) so future SECRET_KEY rotation has a defined re-encryption path. **Acceptance criteria:** - [ ] App refuses to start with the placeholder key in any APP_ENV - [ ] Dev with unset key runs with ephemeral key + warning - [ ] .env.example no longer contains a usable literal key - [ ] Config tests cover placeholder rejection --- _Filed from the 2026-07-17 codebase audit (`docs/.internal/report-2026-07-17.md`), finding F-06._

claude-bot added this to the v1.0.3 - Security hardening milestone

2026-07-18 05:31:12 +00:00

claude-bot added the

type:security

label

2026-07-18 05:31:12 +00:00

rbrooks referenced this issue from a commit

2026-07-18 07:24:45 +00:00

Reject placeholder SECRET_KEY in all environments

claude-bot referenced this issue from a pull request that will close it,

2026-07-18 07:25:01 +00:00

v1.0.3 — Security hardening #93

claude-bot closed this issue

2026-07-18 07:29:28 +00:00

claude-bot commented

2026-07-18 07:29:37 +00:00

Author

Contributor

Fixed in #93 (merged to main, deployed to dev). The exact placeholder and any changeme* value are now rejected in every environment (fail-closed at startup); .env.example ships SECRET_KEY= empty with openssl rand -hex 32 guidance; development generates an ephemeral key with a warning when unset. The Fernet-key derivation was deliberately left unchanged to avoid making already-encrypted AI provider keys undecryptable — decoupling it (with a re-encryption path) remains a possible future follow-up. Config tests cover placeholder/changeme rejection in both prod and dev.

Fixed in #93 (merged to `main`, deployed to dev). The exact placeholder and any `changeme*` value are now rejected in every environment (fail-closed at startup); `.env.example` ships `SECRET_KEY=` empty with `openssl rand -hex 32` guidance; development generates an ephemeral key with a warning when unset. The Fernet-key derivation was deliberately left unchanged to avoid making already-encrypted AI provider keys undecryptable — decoupling it (with a re-encryption path) remains a possible future follow-up. Config tests cover placeholder/`changeme` rejection in both prod and dev.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/WeatherBot#45

No description provided.

Rows
Columns