os.getenv() returns empty string instead of using default when env var is set but empty. This caused SECRET_KEY to be empty when FLASK_SECRET_KEY="" was in .env, breaking Flask sessions/flash messages. Now treats empty string same as unset, properly falling back to SESSION_SECRET. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>