diff --git a/backend/settings.py b/backend/settings.py
index a3fee14..e568cea 100644
--- a/backend/settings.py
+++ b/backend/settings.py
@@ -8,10 +8,10 @@
 
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'changeme'
+SECRET_KEY = os.environ.get('SECRET_KEY', 'changeme')
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
+DEBUG = os.environ.get('DEBUG', 'False') == 'True'
 
 ALLOWED_HOSTS = ["*"]
 CSRF_TRUSTED_ORIGINS=["https://*.aldryn.io"]