Secret key must be unique and secret for every installation.

[emorozov]

Current implementation uses same open SECRET_KEY for all installations. This creates a severe vulnerability.

According to the documentation, changing the secret key will invalidate:

• All sessions if you are using any other session backend than django.contrib.sessions.backends.cache, or are using the default get_session_auth_hash().
• All messages if you are using CookieStorage or FallbackStorage.
• All PasswordResetView tokens.
• Any usage of cryptographic signing, unless a different key is provided.

[codecov]

Codecov Report

Merging #61 (5ec6014) into develop (9e0eeef) will not change coverage.
The diff coverage is 100.00%.

@@           Coverage Diff            @@
##           develop      #61   +/-   ##
========================================
  Coverage    98.31%   98.31%           
========================================
  Files            5        5           
  Lines          119      119           
  Branches         4        4           
========================================
  Hits           117      117           
  Misses           2        2           

Impacted Files	Coverage Δ
parrot/settings.py	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9e0eeef...5ec6014. Read the comment docs.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities (and 0 Security Hotspots to review)
0 Code Smells

No Coverage information
0.0% Duplication