> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Wtforms hardcoded csrf secret

<AccordionGroup>
  <Accordion title="wtforms-hardcoded-csrf-secret">
    A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`<br />**Likelihood**: LOW<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-798: Use of Hard-coded Credentials
    <br />**OWASP**: <br />- A07:2021 - Identification and Authentication Failures
  </Accordion>
</AccordionGroup>