docs: warnings for dotenv vulnerability (#10138)

* dotenv-warnings-and-164-patch

Dotenv warnings and 164 patch.

* Apply suggestions from code review

* remove-pragma-flags

* Apply suggestion from @mendonk

* Apply suggestion from @mendonk

* Apply suggestion from @mendonk

---------

Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>

.pre-commit-config.yaml

@@ -30,7 +30,7 @@ repos:
     hooks:
       - id: detect-secrets
         args: ["--baseline", ".secrets.baseline"]
-        exclude: ^docs/
+        exclude: '(^docs/|^SECURITY\.md$)'
   - repo: local
     hooks:
       - id: local-biome-check

README.md

@@ -14,6 +14,7 @@
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/langflow-ai/langflow)
 
 > [!CAUTION]
+> - Langflow versions 1.6.0 through 1.6.3 have a critical bug where `.env` files are not read, potentially causing security vulnerabilities. **DO NOT** upgrade to these versions if you use `.env` files for configuration. Instead, upgrade to 1.6.4, which includes a fix for this bug.
 > - Windows users of Langflow Desktop should **not** use the in-app update feature to upgrade to Langflow version 1.6.0. For upgrade instructions, see [Windows Desktop update issue](https://docs.langflow.org/release-notes#windows-desktop-update-issue).
 > - Users must update to Langflow >= 1.3 to protect against [CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248)
 > - Users must update to Langflow >= 1.5.1 to protect against [CVE-2025-57760](https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r)

SECURITY.md

@@ -42,6 +42,19 @@ We appreciate your efforts in helping us maintain a secure platform and look for
 
 ## Known Vulnerabilities
 
+### Environment Variable Loading Bug (Fixed in 1.6.4)
+
+Langflow versions `1.6.0` through `1.6.3` have a critical bug where environment variables from `.env` files are not being read. This affects all deployments using environment variables for configuration, including security settings.
+
+**Potential security impact:**
+- Environment variables from `.env` files are not read.
+- Security configurations like `AUTO_LOGIN=false` may not be applied, potentially allowing users to log in as the default superuser.
+- Database credentials, API keys, and other sensitive configuration may not be loaded.
+
+**DO NOT** upgrade to Langflow versions `1.6.0` through `1.6.3` if you use `.env` files for configuration. Instead, upgrade to version `1.6.4`, which includes a fix for this bug.
+
+**Fixed in**: Langflow >= 1.6.4
+
 ### Code Execution Vulnerability (Fixed in 1.3.0)
 
 Langflow allows users to define and run **custom code components** through endpoints like `/api/v1/validate/code`. In versions < 1.3.0, this endpoint did not enforce authentication or proper sandboxing, allowing **unauthenticated arbitrary code execution**.
@@ -99,4 +112,4 @@ export LANGFLOW_SUPERUSER="<your-superuser-username>"
 export LANGFLOW_SUPERUSER_PASSWORD="<your-superuser-password>"
 export LANGFLOW_DATABASE_URL="<your-production-database-url>" # e.g. "postgresql+psycopg://langflow:secure_pass@db.internal:5432/langflow"
 export LANGFLOW_SECRET_KEY="your-strong-random-secret-key"
-```
+```

docs/docs/Support/release-notes.mdx

@@ -52,6 +52,19 @@ To avoid the impact of potential breaking changes and test new versions, the Lan
 Highlights of this release include the following changes.
 For all changes, see the [Changelog](https://github.com/langflow-ai/langflow/releases).
 
+### Known issue, potential security vulnerability: .env file not loaded in versions 1.6.0 through 1.6.3 {#env-file-bug}
+
+Langflow versions 1.6.0 through 1.6.3 have a critical bug where environment variables from `.env` files aren't read.
+This affects all deployments using environment variables for configuration, including security settings.
+
+:::Warning Potential security vulnerability
+If your `.env` file includes `AUTO_LOGIN=false`, upgrading to the impacted versions causes Langflow to fall back to default settings, potentially giving all users superuser access immediately upon upgrade.
+Additionally, database credentials, API keys, and other sensitive configurations can't be loaded from `.env` files.
+
+_Don't_ upgrade to any Langflow version from 1.6.0 through 1.6.3 if you use `.env` files for configuration.
+Instead, upgrade to 1.6.4, which includes a fix for this bug.
+:::
+
 ### Known issue: Don't auto-upgrade Windows Desktop {#windows-desktop-update-issue}
 
 :::warning