Skip to main content
feather security-check audits an app the way a reviewer would, and exits non-zero if anything fails. Run it in CI and before every deploy.

​
What it checks

  • The secret key’s strength, and that it is not the development default
  • That an environment is explicitly selected and debug is off
  • Session and remember-me cookie flags
  • CSRF
  • The RQ job serializer
  • Redis URLs without a password
  • OAUTH_CALLBACK_URL and TRUSTED_HOSTS
  • Security headers
  • That .env is gitignored
  • That installed dependencies meet the framework’s minimum versions

​
What to set in production

Beyond a strong SECRET_KEY:
Set it to the hostnames you serve. Without it, a client-supplied Host header determines your OAuth redirect URI and every external URL you generate.
Set it to the exact callback you registered with Google, https:// and the right hostname, www included.
If you use RQ. Pickle payloads are code execution for anyone who can write to your Redis.
And rediss:// if it crosses a network.

​
Uploads

LocalStorage serves files from static/, where the browser takes the content type from the extension. Script-capable extensions are refused by default, so an uploaded page cannot run on your origin. To accept SVG, set STORAGE_ALLOWED_EXTENSIONS to the list you do want. See File storage.

The full production checklist

Everything to confirm before the first real user.