diff --git a/app.py b/app.py
index 74b0df7..105030d 100644
--- a/app.py
+++ b/app.py
@@ -1,4 +1,6 @@
 import os
+import random
+import string
 from pathlib import Path
 
 import petname
@@ -11,9 +13,15 @@ from werkzeug.utils import secure_filename
 from wtforms import HiddenField, RadioField, StringField
 from wtforms.validators import DataRequired
 
+
+def rand():
+    """Generated random secret."""
+    return "".join(random.choices(string.ascii_uppercase + string.digits, k=N))
+
+
 app = Flask(__name__)
-app.config["SECRET_KEY"] = "foo"
-app.config["WTF_CSRF_SECRET_KEY"] = "bar"
+app.config["SECRET_KEY"] = os.environ.get("SECRET_KEY", rand())
+app.config["WTF_CSRF_SECRET_KEY"] = os.environ.get("WTF_CSRF_SECRET_KEY", rand())
 
 
 CWD = Path().resolve()