SH206: Hard-coded framework secret key

Severity: high · Category: secrets · Applies to: django, fastapi, flask

Why it matters

SECRET_KEY signs sessions, tokens and password-reset links. A key committed to the repository, or left as a default fallback, lets anyone who reads the code forge them.

How to fix

Load the key from an environment variable or a secret manager and fail to start when it is missing.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH206

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH206