DevelopmentConfig has a hardcoded SECRET_KEY with no guard against accidental production use

[abhishek-8081]

In src/cryptoadvance/specter/config.py (line 220), the DevelopmentConfig class sets:

SECRET_KEY = "development key"

This is a static, well-known string. Flask uses SECRET_KEY for signing session cookies and CSRF tokens. If someone accidentally runs the app with DevelopmentConfig in a non-localhost setup (which can happen if the config env variable isn't set properly, or during a rushed deployment), all session cookies become predictable. An attacker who knows this string could forge sessions.

ProductionConfig correctly uses secrets.token_urlsafe(16), so the production path is fine. But there's no runtime check or warning that tells the user "hey, you're running with a dev config on a non-localhost address, that's not safe."

A simple fix could be adding a warning log at startup if SECRET_KEY is set to a known default value and the server is not bound to localhost. Or even just adding a comment in the config making it more obvious that this should never be used outside of local development.

[al-munazzim]

Good catch. The hardcoded SECRET_KEY = "development key" in DevelopmentConfig is indeed a risk if someone accidentally runs dev config on a non-localhost setup.

Assessment: Valid low-severity security improvement. ProductionConfig is fine (secrets.token_urlsafe(16)), so the attack surface is limited to misconfigured deployments.

Suggested fix: Add a startup warning in create_app() or init_app() — something like:

if app.config['SECRET_KEY'] == 'development key' and not app.config.get('TESTING'):
    import logging
    logging.getLogger(__name__).warning(
        'Running with default SECRET_KEY — do not use in production!'
    )

This is a small, safe change. Happy to submit a PR if maintainers agree with the approach.

[al-munazzim]

Triage Assessment

Type: Security issue
Verdict: Should be fixed
Priority: Medium

This is a valid security concern. The DevelopmentConfig class has a hardcoded SECRET_KEY which could pose risks if accidentally used in production.

Proposed fix: Add a runtime warning during app startup if:

• SECRET_KEY equals "development key" AND
• Server is not bound to localhost

This would alert users if they accidentally deploy with development config.

The fix should be straightforward - add a check in the app initialization code and log a warning when this unsafe condition is detected.

Would you like to submit a PR for this fix?

[abhishek-8081]

Yes , You can go ahead .