id: PY-SEC-043
name: flask-secret-key
severity: high
language: python
cwe: CWE-798
owasp: "A02:2021"
description: "Detect insecure Flask secret key configuration including hardcoded or weak values."
pattern:
  type: regex
  regex:
    - 'app\.secret_key\s*=\s*[\"'']'
    - 'SECRET_KEY\s*=\s*[\"''][a-zA-Z0-9]'
    - 'app\.config\s*\[\s*[\"'']SECRET_KEY[\"'']\s*\]\s*=\s*[\"'']'
message: "Hardcoded or insecure Flask secret key detected. Weak secret keys allow session forgery and cookie tampering."
fix_hint: "Load SECRET_KEY from environment variables. Use os.urandom(32) or secrets.token_hex(32) to generate strong keys."
references:
  - https://cwe.mitre.org/data/definitions/798.html
  - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
