I know the
SECRET_KEY for a website made in Django. The owner of the site has accidentally made the
What are the implications of making SECRET_KEY public? How can someone use this to attack the system?
From Django's official documentation, they have only mentioned what the SECRET_KEY is used for:
The secret key is used for:
- All sessions if you are using any other session backend than django.contrib.sessions.backends.cache, or are using the default
- All messages if you are using CookieStorage or FallbackStorage.
- All PasswordResetView tokens.
- Any usage of cryptographic signing, unless a different key is provided.