# X_CURSOR_SECRET_DEV

## Means

cursors are signed with the shipped development key

## Typical cause

`ULTIMATE_CURSOR_SECRET` is unset — or set to the EMPTY string, which counts as unset and never as an empty HMAC key — outside `development`/`test`, so the signing key is the constant published in `@ultimat3/core` and a client can forge a page position. A process naming NO environment (`ULTIMATE_ENV`/`NODE_ENV` both unset) counts as production. Reported by `x doctor` as a warning, and **thrown at boot** by `assertNoDevSecretsOutsideLocal()`

## Fix

`openssl rand -hex 32   # put the output in this deploy's secret store as ULTIMATE_CURSOR_SECRET; this machine: ULTIMATE_ENV=development x env check`

[Core and runtime](/error-codes#core-and-runtime)