From 6d57dc9451eb4e5ad1a21310a3a78e0c3e688478 Mon Sep 17 00:00:00 2001
From: liushengyang <liushengyang@bytedance.com>
Date: Mon, 30 Mar 2026 14:37:25 +0800
Subject: [PATCH 1/2] fix(backend): SessionHMACKey in env

---
 backend/infra/middleware/session/session.go | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/backend/infra/middleware/session/session.go b/backend/infra/middleware/session/session.go
index 7e9235115..f27f8f27b 100644
--- a/backend/infra/middleware/session/session.go
+++ b/backend/infra/middleware/session/session.go
@@ -8,6 +8,7 @@ import (
 	"crypto/hmac"
 	"crypto/sha256"
 	"encoding/base64"
+	"os"
 	"time"
 
 	"github.com/coze-dev/coze-loop/backend/pkg/errorx"
@@ -18,10 +19,21 @@ import (
 const (
 	SessionKey     = "session_key"
 	SessionExpires = 7 * 24 * time.Hour
+
+	defaultHMACSecret = "openloop-session-hmac-key"
+	envSessionHMACKey = "COZE_LOOP_SESSION_HMAC_KEY"
 )
 
-// 用于签名的密钥（在实际应用中应从配置中读取或使用环境变量）
-var hmacSecret = []byte("openloop-session-hmac-key")
+// Signing key: prefer `COZE_LOOP_SESSION_HMAC_KEY` from environment; fall back to the default.
+var hmacSecret []byte
+
+func init() {
+	if v := os.Getenv(envSessionHMACKey); v != "" {
+		hmacSecret = []byte(v)
+	} else {
+		hmacSecret = []byte(defaultHMACSecret)
+	}
+}
 
 type Session struct {
 	UserID string

From 0aeaa4d2d79004d34153c6a1ff7de09a3f05c693 Mon Sep 17 00:00:00 2001
From: liushengyang <liushengyang@bytedance.com>
Date: Mon, 30 Mar 2026 15:14:03 +0800
Subject: [PATCH 2/2] fix(infra): readme security warning

---
 README.cn.md | 3 +++
 README.md    | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/README.cn.md b/README.cn.md
index eda9fb034..4c34e5944 100644
--- a/README.cn.md
+++ b/README.cn.md
@@ -115,6 +115,9 @@ Coze Loop 通过提供全生命周期的管理能力，帮助开发者更高效
 6. 开始定制你的 Coze Loop 项目。
    参考 `examples/` 目录示例，修改 `values.yaml` 即可覆盖默认设置，修改后重新执行 `make helm-up` 生效。
 
+> [!WARNING]
+> 如果要将 Coze Loop 部署到公网环境，建议在部署前评估整体评估安全风险，例如账号注册功能、Coze Server 监听地址配置、SSRF 和部分 API 水平越权的风险，并采取相应防护措施。详细信息可参考[快速开始](https://github.com/coze-dev/coze-loop/wiki/2.-%E5%BF%AB%E9%80%9F%E5%BC%80%E5%A7%8B#%E5%85%AC%E7%BD%91%E5%AE%89%E5%85%A8%E9%A3%8E%E9%99%A9)。
+
 ## 使用 Coze Loop 开源版
 
 * [Prompt 开发与调试](https://loop.coze.cn/open/docs/cozeloop/create-prompt)：Coze Loop 提供了完整的提示词开发流程。
diff --git a/README.md b/README.md
index 0551ce737..452a42d4f 100644
--- a/README.md
+++ b/README.md
@@ -115,6 +115,9 @@ Procedure:
 6. Start customizing your Coze Loop project.
    Refer to the examples in the `examples/` directory. Modify `values.yaml` to override the default settings. After making changes, rerun `make helm-up` for the changes to take effect.
 
+> [!WARNING]
+> If you want to deploy Coze Loop in a public network environment, it is recommended to assess security risks before you begin, and take corresponding protection measures. Possible security risks include account registration functions, Coze Server listening address configurations, SSRF (Server - Side Request Forgery), and some horizontal privilege escalations in APIs.  For more details, refer to [Quickstart](https://github.com/coze-dev/coze-loop/wiki/2.-Quickstart#security-risks-in-public-networks).
+
 ## Use the Coze Loop open source version
 
 * [Prompt development and debugging](https://loop.coze.cn/open/docs/cozeloop/create-prompt): Coze Loop provides a complete prompt development workflow.