diff --git a/README.md b/README.md
index 50e4858..3217960 100644
--- a/README.md
+++ b/README.md
@@ -9,11 +9,12 @@ How-To
 
 * Clone the repo.
 * Add a git remote called ``heroku`` pointing at ``git@heroku.com:insertcreativenamehere.git``.
-* Create a file called .env and add two values: ``DATABASE_URL=sqlite://localhost/local.db`` and ``DEBUG=True``.
+* Create a file called .env and add: ``DATABASE_URL=sqlite://localhost/local.db``, ``SECRET_KEY=<some secret key>`` and ``DEBUG=True``.
 * Run ``make run``.
 * Open http://localhost:8000
 * Hack.
 
+**NEVER** commit your .env file!
 
 Run local commands
 ------------------
diff --git a/settings.py b/settings.py
index 7032b42..8df0dd5 100644
--- a/settings.py
+++ b/settings.py
@@ -13,6 +13,9 @@ LANGUAGE_CODE = 'en'
 
 SITE_ID = 1
 
+assert 'SECRET_KEY' in os.environ, 'Set SECRET_KEY in your .env file!'
+SECRET_KEY = os.environ['SECRET_KEY']
+
 USE_L10N = USE_I18N = False
 
 MEDIA_ROOT = os.path.join(PROJECT_DIR, 'media')