Will It Vibe?Secret key falls back to a hardcoded literal
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
os.environ.get('SECRET_KEY', 'literal') or os.getenv('SECRET_KEY', 'literal') ships the literal as a real, guessable secret_key whenever the environment variable is unset, which signs session cookies and CSRF tokens.
Why it matters
os.environ.get('SECRET_KEY', 'some-literal') or os.getenv('SECRET_KEY', 'some-literal') looks like it reads the secret from configuration, but the literal second argument is a real, working secret_key the moment the environment variable is not set, which happens on a fresh deploy, a misconfigured container, or a local run with no .env loaded. Flask's secret_key signs session cookies and CSRF tokens, so anyone who reads this file from the repository can forge both.
How to fix it
Remove the literal fallback and fail fast instead: read the variable with os.environ["SECRET_KEY"] (which raises if missing) or check for None explicitly and raise a clear configuration error. Generate the real value once with python -c "import secrets; print(secrets.token_hex(32))" and store it only in your secret manager or an untracked .env file, then rotate it if the fallback literal was ever committed.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo