From 4a915f8e3adf2221e42525b3a6e6d4b51c7da164 Mon Sep 17 00:00:00 2001
From: Trenton H <797416+stumpylog@users.noreply.github.com>
Date: Mon, 4 May 2026 06:11:56 -0700
Subject: [PATCH] Fix: Always require a set, non-empty, not whitespace secret
 key, even in DEBUG (#12680)

---
 src/paperless/settings/__init__.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/paperless/settings/__init__.py b/src/paperless/settings/__init__.py
index 95bbe46c5a..db57173cdb 100644
--- a/src/paperless/settings/__init__.py
+++ b/src/paperless/settings/__init__.py
@@ -464,8 +464,7 @@ SECURE_PROXY_SSL_HEADER = (
 )
 
 SECRET_KEY = os.getenv("PAPERLESS_SECRET_KEY")
-_INSECURE_SECRET_KEYS = {None, "", "change-me"}
-if not DEBUG and SECRET_KEY in _INSECURE_SECRET_KEYS:  # pragma: no cover
+if not (SECRET_KEY or "").strip() or SECRET_KEY == "change-me":  # pragma: no cover
     raise ImproperlyConfigured(
         "PAPERLESS_SECRET_KEY is not set or is the default 'change-me' value. "
         "A unique, secret key is required for secure operation. "