Security Key and Boilerplate We have set up a Craft 3 installation with composer to serve as boilerplate for a number of upcoming projects. The installation sits in a private git repository and the plan is to clone it when we start a new project.

Everything works fine, but since new projects will spawn from the boilerplate, the Security Key is the same for all of them - which probably is a bad idea.

Is there a way to assign a new security key when we clone the boilerplate for a new project? Are there other security considerations to take into account?

Thanks a lot!
You can run the craft setup/security-key console command after cloning the repo.  That'll generate a security key for that Craft install and put it in the local .env file.

Or for that matter, craft setup will run the whole setup process (database credeitials, security key, etc.).


  Are there other security considerations to take into account?


Keep your craft/config/license.key out of the repo so that a new one is generated for each cloned site.