Keith SmithandClaude Sonnet 4.5 a22c3eed50 Fix Critical Security Issue: Remove weak default SECRET_KEY ...

Security improvements:
- selfhosted.py: Require SECRET_KEY environment variable (raises ValueError if not set)
- selfhosted.py: Validate SECRET_KEY length (minimum 50 characters)
- selfhosted.py: Warn if DEBUG=True in self-hosted mode
- development.py: Auto-generate random SECRET_KEY on each startup if not provided
- development.py: Remove production domain from ALLOWED_HOSTS
- development.py: Make CSRF_TRUSTED_ORIGINS environment-only

This prevents weak/default SECRET_KEYs from being used in production.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2025-12-22 22:31:46 -07:00

..

__init__.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

base.py

Add email verification, admin approval, and user profile enhancements

2025-12-22 18:13:38 -07:00

development.py

Fix Critical Security Issue: Remove weak default SECRET_KEY

2025-12-22 22:31:46 -07:00

production.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

selfhosted.py

Fix Critical Security Issue: Remove weak default SECRET_KEY

2025-12-22 22:31:46 -07:00