fix(security): remove insecure default secret from GOOSE_EXTERNAL_BACKEND (#7783)

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
2026-03-10 16:27:37 +01:00
parent a191f0d958
commit b6d6984125
4 changed files with 30 additions and 5 deletions
@@ -144,6 +144,7 @@ debug-ui *alpha:
    @echo "🚀 Starting goose frontend in external backend mode{{ if alpha == "alpha" { " with alpha features enabled" } else { "" } }}"
    cd ui/desktop && \
    export GOOSE_EXTERNAL_BACKEND=true && \
+    export GOOSE_SERVER__SECRET_KEY="${GOOSE_SERVER__SECRET_KEY:-test}" && \
    {{ if alpha == "alpha" { "export ALPHA=true &&" } else { "" } }} \
    npm ci && \
    npm run {{ if alpha == "alpha" { "start-alpha-gui" } else { "start-gui" } }}