Django is pretty serious about warning you of the risks of this [1]. I think in this case the key was in some third party options variable so the bug is there.

Django is pretty serious about warning you of the risks of this [1]. I think in this case the key was in some third party options variable so the bug is there. The sentry thing sounds like an internal bug to Facebook rather than a django issue. [1] https://docs.djangoproject.com/en/2.1/topics/http/sessions/#using-cookie-based-sessions https://docs.djangoproject.com/en/2.1/topics/http/sessions/#...