diff --git a/docker.env b/docker.env
index bc0c3c9d5..f587e8335 100644
--- a/docker.env
+++ b/docker.env
@@ -1,8 +1,14 @@
+# WARNING: These are default values for local development only.
+# DO NOT use these values in production. Generate proper secret keys.
 POSTGRES_DB=vulnerablecode
+
 POSTGRES_USER=vulnerablecode
 POSTGRES_PASSWORD=vulnerablecode
 
 VULNERABLECODE_DB_HOST=db
 VULNERABLECODE_STATIC_ROOT=/var/vulnerablecode/static/
 
-VULNERABLECODE_REDIS_HOST=vulnerablecode_redis
\ No newline at end of file
+VULNERABLECODE_REDIS_HOST=vulnerablecode_redis
+SECRET_KEY=secret
+ALTCHA_HMAC_KEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+# ALTCHA_HMAC_KEY must be a 32-byte (64 hex characters) hexadecimal key; override this value in production.