handle security risks

Author: gkorland

api/app_factory.py

@@ -22,7 +22,11 @@
 def create_app():
     """Create and configure the Flask application."""
     app = Flask(__name__)
-    app.secret_key = os.getenv("FLASK_SECRET_KEY", "supersekrit")
+    app.secret_key = os.getenv("FLASK_SECRET_KEY")
+    if not app.secret_key:
+        import secrets
+        app.secret_key = secrets.token_hex(32)
+        logging.warning("FLASK_SECRET_KEY not set, using generated key. Set this in production!")
 
     # Google OAuth setup
     GOOGLE_CLIENT_ID = os.getenv("GOOGLE_CLIENT_ID")

api/index.py

@@ -5,4 +5,9 @@
 app = create_app()
 
 if __name__ == "__main__":
-    app.run(debug=True)
+    import os
+    debug_mode = os.environ.get('FLASK_DEBUG', 'False').lower() == 'true'
+    app.run(debug=debug_mode)
+# This allows running the app with `flask run` or directly with `python api/index.py`
+# Ensure the environment variable FLASK_DEBUG is set to 'True' for debug mode
+# or 'False' for production mode.