`FLASK_DEBUG` is `false` in production - `SECRET_KEY` is a long random string, not a hardcoded default - All secrets are in platform environment variables, not in source code - `.env` is in `.gitignore`