diff --git a/.github/workflows/maze-runner.yml b/.github/workflows/maze-runner.yml
index 85d26756..17297807 100644
--- a/.github/workflows/maze-runner.yml
+++ b/.github/workflows/maze-runner.yml
@@ -2,6 +2,9 @@ name: Maze Runner
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   maze-runner:
     runs-on: 'ubuntu-latest'
diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index 5cfef9cf..d945445f 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -2,6 +2,9 @@ name: Test bugsnag-python against Python versions
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
@@ -46,6 +49,8 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     container: python:3-slim
+    permissions:
+      contents: none
     steps:
     - name: Send request
       run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 39eebfee..1fbe231f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,11 +1,19 @@
 Changelog
 =========
 
+## v4.9.2 (2026-09-15)
+
+### Security
+
+* Replace hardcoded Django `SECRET_KEY` values with environment variables in example apps and test fixtures [#423](https://github.com/bugsnag/bugsnag-python/pull/423)
+* Upgrade WebOb to 1.8.11 in example apps to remediate known security vulnerabilities [#424](https://github.com/bugsnag/bugsnag-python/pull/424)
+
 ## v4.9.1 (2026-06-18)
 
 ### Enhancements
 
 * Add support for `level` parameter in `BugsnagHandler` constructor and `Client.log_handler()` method.
+  [#416](https://github.com/bugsnag/bugsnag-python/pull/416)
 
 ## v4.9.0 (2026-04-21)
 
diff --git a/bugsnag/__init__.py b/bugsnag/__init__.py
index 925ae5b1..dbd0c625 100644
--- a/bugsnag/__init__.py
+++ b/bugsnag/__init__.py
@@ -18,7 +18,7 @@
                             clear_feature_flag, clear_feature_flags,
                             aws_lambda_handler)
 
-__version__ = '4.9.1'
+__version__ = '4.9.2'
 
 __all__ = ('Client', 'Event', 'Configuration', 'RequestConfiguration',
            'configuration', 'configure', 'configure_request',
diff --git a/bugsnag/notifier.py b/bugsnag/notifier.py
index 709088ad..a699004d 100644
--- a/bugsnag/notifier.py
+++ b/bugsnag/notifier.py
@@ -1,5 +1,5 @@
 _NOTIFIER_INFORMATION = {
     'name': 'Python Bugsnag Notifier',
     'url': 'https://github.com/bugsnag/bugsnag-python',
-    'version': '4.9.1'
+    'version': '4.9.2'
 }
diff --git a/example/celery+django/celery_django/settings.py b/example/celery+django/celery_django/settings.py
index 7fe170c8..c52f75bd 100644
--- a/example/celery+django/celery_django/settings.py
+++ b/example/celery+django/celery_django/settings.py
@@ -20,7 +20,10 @@
 # See https://docs.djangoproject.com/en/1.11/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 't70qw62gdx%ru%w1&f#$so*a$h9-m6h#a1=gji9$5q&)exf$*%'
+SECRET_KEY = os.environ.get(
+    'DJANGO_SECRET_KEY',
+    'django-insecure-testonly-not-a-real-secret-key-replace-me',
+)
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
diff --git a/example/celery+django/requirements.txt b/example/celery+django/requirements.txt
index 6134a7fc..327f8bc4 100644
--- a/example/celery+django/requirements.txt
+++ b/example/celery+django/requirements.txt
@@ -8,4 +8,4 @@ markdown==3.4.1
 pytz==2022.5
 redis==4.3.4
 vine==5.0.0
-WebOb==1.8.7
+WebOb==1.8.11
diff --git a/example/django21/bugsnag_demo/settings.py b/example/django21/bugsnag_demo/settings.py
index ecc58277..e4885815 100644
--- a/example/django21/bugsnag_demo/settings.py
+++ b/example/django21/bugsnag_demo/settings.py
@@ -18,7 +18,10 @@
 # See https://docs.djangoproject.com/en/2.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = '3n3h7r@tpqnwqtt8#avxh_t75k_6zf3x)@6cg!u(&xmz79(26h'
+SECRET_KEY = os.environ.get(
+    'DJANGO_SECRET_KEY',
+    'django-insecure-testonly-not-a-real-secret-key-replace-me',
+)
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
diff --git a/example/django31/todo/settings.py b/example/django31/todo/settings.py
index 80ddedb5..2dc42416 100644
--- a/example/django31/todo/settings.py
+++ b/example/django31/todo/settings.py
@@ -22,7 +22,10 @@
 # See https://docs.djangoproject.com/en/3.1/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = '$#yb)ri-v$^#8o1r0x%5$0yy&aqu2yefwo10zm+(=7!t+d^6ft'
+SECRET_KEY = os.environ.get(
+    'DJANGO_SECRET_KEY',
+    'django-insecure-testonly-not-a-real-secret-key-replace-me',
+)
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
diff --git a/example/flask/requirements.txt b/example/flask/requirements.txt
index dc354751..ec0770f6 100644
--- a/example/flask/requirements.txt
+++ b/example/flask/requirements.txt
@@ -5,5 +5,5 @@ Flask==1.1.2
 itsdangerous==1.1.0
 Jinja2==2.11.2
 MarkupSafe==1.1.1
-WebOb==1.8.6
+WebOb==1.8.11
 Werkzeug==1.0.1
diff --git a/setup.py b/setup.py
index be3e9477..ac538529 100755
--- a/setup.py
+++ b/setup.py
@@ -14,7 +14,7 @@
 
 setup(
     name='bugsnag',
-    version='4.9.1',
+    version='4.9.2',
     description='Automatic error monitoring for django, flask, etc.',
     long_description=__doc__,
     author='Simon Maynard',
diff --git a/tests/fixtures/django30/todo/settings.py b/tests/fixtures/django30/todo/settings.py
index ac11d39f..8f505374 100644
--- a/tests/fixtures/django30/todo/settings.py
+++ b/tests/fixtures/django30/todo/settings.py
@@ -22,7 +22,7 @@
 # See https://docs.djangoproject.com/en/3.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = '$#yb)ri-v$^#8o1r0x%5$0yy&aqu2yefwo10zm+(=7!t+d^6ft'
+SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me'
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False
diff --git a/tests/fixtures/django4/todo/settings.py b/tests/fixtures/django4/todo/settings.py
index 1458b48a..1fead5d2 100644
--- a/tests/fixtures/django4/todo/settings.py
+++ b/tests/fixtures/django4/todo/settings.py
@@ -21,7 +21,7 @@
 # See https://docs.djangoproject.com/en/4.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-z++&i7gx^m*qqq_1(xjqo=7%gg)^&fcq6fa3gen+10(zn5756z'
+SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me'
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False
diff --git a/tests/fixtures/django5/todo/settings.py b/tests/fixtures/django5/todo/settings.py
index 378ee386..1afec6cd 100644
--- a/tests/fixtures/django5/todo/settings.py
+++ b/tests/fixtures/django5/todo/settings.py
@@ -21,7 +21,7 @@
 # See https://docs.djangoproject.com/en/5.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-z++&i7gx^m*qqq_1(xjqo=7%gg)^&fcq6fa3gen+10(zn5756z'
+SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me'
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False
diff --git a/tests/fixtures/django6/todo/settings.py b/tests/fixtures/django6/todo/settings.py
index c0cee231..6532fbe8 100644
--- a/tests/fixtures/django6/todo/settings.py
+++ b/tests/fixtures/django6/todo/settings.py
@@ -21,7 +21,7 @@
 # See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-z++&i7gx^m*qqq_1(xjqo=7%gg)^&fcq6fa3gen+10(zn5756z'
+SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me'
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False