{"record":{"id":"21e957c37cd64300","repo":"affaan-m/ECC","slug":"django-secret-key-environment-variable-is-required","errorCode":null,"errorMessage":"DJANGO_SECRET_KEY environment variable is required","messagePattern":"DJANGO_SECRET_KEY environment variable is required","errorType":"exception","errorClass":"ImproperlyConfigured","httpStatus":null,"severity":"critical","filePath":"skills/django-security/SKILL.md","lineNumber":52,"sourceCode":"SESSION_COOKIE_SECURE = True\nCSRF_COOKIE_SECURE = True\nSECURE_HSTS_SECONDS = 31536000  # 1 year\nSECURE_HSTS_INCLUDE_SUBDOMAINS = True\nSECURE_HSTS_PRELOAD = True\nSECURE_CONTENT_TYPE_NOSNIFF = True\nSECURE_BROWSER_XSS_FILTER = True\nX_FRAME_OPTIONS = 'DENY'\n\n# HTTPS and Cookies\nSESSION_COOKIE_HTTPONLY = True\nCSRF_COOKIE_HTTPONLY = True\nSESSION_COOKIE_SAMESITE = 'Lax'\nCSRF_COOKIE_SAMESITE = 'Lax'\n\n# Secret key (must be set via environment variable)\nSECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')\nif not SECRET_KEY:\n    raise ImproperlyConfigured('DJANGO_SECRET_KEY environment variable is required')\n\n# Password validation\nAUTH_PASSWORD_VALIDATORS = [\n    {\n        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',\n    },\n    {\n        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',\n        'OPTIONS': {\n            'min_length': 12,\n        }\n    },\n    {\n        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',\n    },\n    {\n        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',\n    },","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/skills/django-security/SKILL.md#L34-L70","documentation":"The django-security skill's settings example reads SECRET_KEY from the DJANGO_SECRET_KEY env var and raises django.core.exceptions.ImproperlyConfigured if it is missing. This is a security best-practice snippet: the secret must be provisioned out-of-band, and Django fails fast at startup rather than running with a default/insecure key. Because settings load on every management command, this guard fires at process start, not at request time.","triggerScenarios":"Starting Django (runserver/gunicorn/management command) without DJANGO_SECRET_KEY in the environment; .env file not loaded before settings access os.environ; SECRET_KEY hardcoded default removed in favor of this guard.","commonSituations":"Fresh deploy missing the secret in the environment; .env not sourced in the WSGI/ASGI process; CI running manage.py without the secret; Docker image missing the env var; local dev after switching from a hardcoded key to env-based.","solutions":["Set DJANGO_SECRET_KEY in the environment for every process that loads settings.","Generate a key: python -c \"from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())\".","Load .env via django-environ / python-dotenv before settings read os.environ.","Use a distinct secret per environment (dev/staging/prod); never commit it."],"exampleFix":"// before\nSECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')\nif not SECRET_KEY:\n    raise ImproperlyConfigured('DJANGO_SECRET_KEY environment variable is required')\n\n// after — allow dev fallback while still failing in non-dev\nimport os\nfrom django.conf import settings as django_settings\nfrom django.core.exceptions import ImproperlyConfigured\n\nSECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')\nif not SECRET_KEY:\n    if django_settings.DEBUG:\n        from django.core.management.utils import get_random_secret_key\n        SECRET_KEY = get_random_secret_key()\n    else:\n        raise ImproperlyConfigured('DJANGO_SECRET_KEY environment variable is required')","handlingStrategy":"validation","validationCode":"import os, sys\n\ndef secret_key_provisioned() -> bool:\n    return bool(os.environ.get(\"DJANGO_SECRET_KEY\")) or \"test\" in sys.argv","typeGuard":null,"tryCatchPattern":"from django.core.exceptions import ImproperlyConfigured\n\ntry:\n    from myproject.settings import *  # noqa\nexcept ImproperlyConfigured as e:\n    if \"DJANGO_SECRET_KEY\" in str(e):\n        print(\"Set DJANGO_SECRET_KEY in the environment\")\n    raise","preventionTips":["Provision DJANGO_SECRET_KEY in every environment that loads settings.","Generate with get_random_secret_key(); never hand-roll.","Use a secret manager for prod, .env (gitignored) for local dev.","Fail-fast at startup is intentional — do not bypass with a hardcoded fallback in prod."],"tags":["django","security","config","secret-key","environment"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}