Pain point · Documentation · Causes churn
Setup docs omit required APP_SECRET guidance
Part of the theme “Require a secure APP_SECRET configuration” · 2 reports · see them all
1 source thread · first seen 2026-09
Summary
The from-source setup documentation omits `APP_SECRET`, even though the app depends on it, and the application silently derives its signing and encryption key from `DATABASE_URL` when it is unset. The author reports security and session invalidation risks from this undocumented fallback.
- Affects
- Self-hosted users installing from source
Evidence
Excerpts are copied word for word from the source; follow the link to read it in full.
“`APP_SECRET` is undocumented, and omitting it is unsafe”