I use OpenID Connect to let my users login. What could happen if Flasks
SECRET_KEY becomes public?
If the openid connect relies on flask's session manager, then the session cookies are predictable.
Flask uses the SECRET_KEY for session management, so if I know you SECRET_KEY, I can make a bogus session cookie and impersonate another user, even the admin user.
This seems the only place SECRET_KEY is used in the source code. I went to github and searched for SECRET_KEY and this is the only code that uses it. The rest of the 15 references were docs, tests, or configuration files.