SB-shivamgarg · Sep 15, 2026 · Aug 4, 2026 · Aug 12, 2026 · Aug 13, 2026 · Sep 15, 2026
diff --git a/.github/workflows/maze-runner.yml b/.github/workflows/maze-runner.yml
@@ -2,6 +2,9 @@ name: Maze Runner
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   maze-runner:
     runs-on: 'ubuntu-latest'

diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
@@ -2,6 +2,9 @@ name: Test bugsnag-python against Python versions
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
@@ -46,6 +49,8 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     container: python:3-slim
+    permissions:
+      contents: none
     steps:
     - name: Send request
       run: |

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,11 +1,19 @@
 Changelog
 =========
 
+## v4.9.2 (2026-09-15)
+
+### Security
+
+* Replace hardcoded Django `SECRET_KEY` values with environment variables in example apps and test fixtures [#423](https://github.com/bugsnag/bugsnag-python/pull/423)
+* Upgrade WebOb to 1.8.11 in example apps to remediate known security vulnerabilities [#424](https://github.com/bugsnag/bugsnag-python/pull/424)
+
 ## v4.9.1 (2026-06-18)
 
 ### Enhancements
 
 * Add support for `level` parameter in `BugsnagHandler` constructor and `Client.log_handler()` method.
+  [#416](https://github.com/bugsnag/bugsnag-python/pull/416)
 
 ## v4.9.0 (2026-04-21)
 

diff --git a/bugsnag/__init__.py b/bugsnag/__init__.py
@@ -18,7 +18,7 @@
                             clear_feature_flag, clear_feature_flags,
                             aws_lambda_handler)
 
-__version__ = '4.9.1'
+__version__ = '4.9.2'
 
 __all__ = ('Client', 'Event', 'Configuration', 'RequestConfiguration',
            'configuration', 'configure', 'configure_request',

diff --git a/bugsnag/notifier.py b/bugsnag/notifier.py
@@ -1,5 +1,5 @@
 _NOTIFIER_INFORMATION = {
     'name': 'Python Bugsnag Notifier',
     'url': 'https://github.com/bugsnag/bugsnag-python',
-    'version': '4.9.1'
+    'version': '4.9.2'
 }
diff --git a/example/celery+django/celery_django/settings.py b/example/celery+django/celery_django/settings.py
@@ -20,7 +20,10 @@
 # See https://docs.djangoproject.com/en/1.11/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 't70qw62gdx%ru%w1&f#$so*a$h9-m6h#a1=gji9$5q&)exf$*%'
+SECRET_KEY = os.environ.get(
+    'DJANGO_SECRET_KEY',
+    'django-insecure-testonly-not-a-real-secret-key-replace-me',
+)
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True

diff --git a/example/celery+django/requirements.txt b/example/celery+django/requirements.txt
@@ -8,4 +8,4 @@ markdown==3.4.1
 pytz==2022.5
 redis==4.3.4
 vine==5.0.0
-WebOb==1.8.7
+WebOb==1.8.11
diff --git a/example/django21/bugsnag_demo/settings.py b/example/django21/bugsnag_demo/settings.py
@@ -18,7 +18,10 @@
 # See https://docs.djangoproject.com/en/2.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = '3n3h7r@tpqnwqtt8#avxh_t75k_6zf3x)@6cg!u(&xmz79(26h'
+SECRET_KEY = os.environ.get(
+    'DJANGO_SECRET_KEY',
+    'django-insecure-testonly-not-a-real-secret-key-replace-me',
+)
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True

diff --git a/example/django31/todo/settings.py b/example/django31/todo/settings.py
@@ -22,7 +22,10 @@
 # See https://docs.djangoproject.com/en/3.1/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = '$#yb)ri-v$^#8o1r0x%5$0yy&aqu2yefwo10zm+(=7!t+d^6ft'
+SECRET_KEY = os.environ.get(
+    'DJANGO_SECRET_KEY',
+    'django-insecure-testonly-not-a-real-secret-key-replace-me',
+)
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True

diff --git a/example/flask/requirements.txt b/example/flask/requirements.txt
@@ -5,5 +5,5 @@ Flask==1.1.2
 itsdangerous==1.1.0
 Jinja2==2.11.2
 MarkupSafe==1.1.1
-WebOb==1.8.6
+WebOb==1.8.11
 Werkzeug==1.0.1
diff --git a/setup.py b/setup.py
@@ -14,7 +14,7 @@
 
 setup(
     name='bugsnag',
-    version='4.9.1',
+    version='4.9.2',
     description='Automatic error monitoring for django, flask, etc.',
     long_description=__doc__,
     author='Simon Maynard',

diff --git a/tests/fixtures/django30/todo/settings.py b/tests/fixtures/django30/todo/settings.py
@@ -22,7 +22,7 @@
 # See https://docs.djangoproject.com/en/3.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = '$#yb)ri-v$^#8o1r0x%5$0yy&aqu2yefwo10zm+(=7!t+d^6ft'
+SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me'
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False

diff --git a/tests/fixtures/django4/todo/settings.py b/tests/fixtures/django4/todo/settings.py
@@ -21,7 +21,7 @@
 # See https://docs.djangoproject.com/en/4.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-z++&i7gx^m*qqq_1(xjqo=7%gg)^&fcq6fa3gen+10(zn5756z'
+SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me'
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False

diff --git a/tests/fixtures/django5/todo/settings.py b/tests/fixtures/django5/todo/settings.py
@@ -21,7 +21,7 @@
 # See https://docs.djangoproject.com/en/5.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-z++&i7gx^m*qqq_1(xjqo=7%gg)^&fcq6fa3gen+10(zn5756z'
+SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me'
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False

diff --git a/tests/fixtures/django6/todo/settings.py b/tests/fixtures/django6/todo/settings.py
@@ -21,7 +21,7 @@
 # See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-z++&i7gx^m*qqq_1(xjqo=7%gg)^&fcq6fa3gen+10(zn5756z'
+SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me'
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False