diff --git a/models/auth/secret.go b/models/auth/secret.go
index 5bf950a50d..da71df9637 100644
--- a/models/auth/secret.go
+++ b/models/auth/secret.go
@@ -32,12 +32,12 @@ var nameRE = regexp.MustCompile("[^a-zA-Z0-9-_.]+")
 // Secret represents a secret
 type Secret struct {
 	ID          int64
-	UserID      int64 `xorm:"index"`
-	RepoID      int64 `xorm:"index"`
-	Name        string
-	Data        string
-	PullRequest bool
-	CreatedUnix timeutil.TimeStamp `xorm:"created"`
+	UserID      int64              `xorm:"index NOTNULL"`
+	RepoID      int64              `xorm:"index NOTNULL"`
+	Name        string             `xorm:"NOTNULL"`
+	Data        string             `xorm:"TEXT"`
+	PullRequest bool               `xorm:"NOTNULL"`
+	CreatedUnix timeutil.TimeStamp `xorm:"created NOTNULL"`
 }
 
 // Validate validates the required fields and formats.
diff --git a/models/db/search.go b/models/db/search.go
index a5bd427ee6..21731e4599 100644
--- a/models/db/search.go
+++ b/models/db/search.go
@@ -35,6 +35,7 @@ const (
 	SearchOrderByForksReverse          SearchOrderBy = "num_forks DESC"
 )
 
+// FindObjects represents a common function to find Objects from database according cond and ListOptions
 func FindObjects[Object any](ctx context.Context, cond builder.Cond, opts *ListOptions, objects *[]*Object) error {
 	sess := GetEngine(ctx).Where(cond)
 	if opts != nil && opts.PageSize > 0 {
diff --git a/models/migrations/v227.go b/models/migrations/v227.go
index d4455c0c4a..f5bbab43e2 100644
--- a/models/migrations/v227.go
+++ b/models/migrations/v227.go
@@ -13,12 +13,12 @@ import (
 func createSecretsTable(x *xorm.Engine) error {
 	type Secret struct {
 		ID          int64
-		UserID      int64 `xorm:"index"`
-		RepoID      int64 `xorm:"index"`
-		Name        string
-		Data        string
-		PullRequest bool
-		CreatedUnix timeutil.TimeStamp `xorm:"created"`
+		UserID      int64              `xorm:"index NOTNULL"`
+		RepoID      int64              `xorm:"index NOTNULL"`
+		Name        string             `xorm:"NOTNULL"`
+		Data        string             `xorm:"TEXT"`
+		PullRequest bool               `xorm:"NOTNULL"`
+		CreatedUnix timeutil.TimeStamp `xorm:"created NOTNULL"`
 	}
 
 	return x.Sync(new(Secret))
diff --git a/modules/generate/generate.go b/modules/generate/generate.go
index 6b788df0a1..29179f905b 100644
--- a/modules/generate/generate.go
+++ b/modules/generate/generate.go
@@ -70,11 +70,5 @@ func NewSecretKey() (string, error) {
 
 // NewMasterKey generate a new value intended to be used by MASTER_KEY.
 func NewMasterKey() ([]byte, error) {
-	secretBytes := make([]byte, 32)
-	_, err := io.ReadFull(rand.Reader, secretBytes)
-	if err != nil {
-		return nil, err
-	}
-
-	return secretBytes, nil
+	return util.CryptoRandomBytes(32)
 }
diff --git a/routers/web/repo/setting.go b/routers/web/repo/setting.go
index 412b117b65..91cde89980 100644
--- a/routers/web/repo/setting.go
+++ b/routers/web/repo/setting.go
@@ -1124,7 +1124,7 @@ func DeployKeys(ctx *context.Context) {
 	ctx.HTML(http.StatusOK, tplDeployKeys)
 }
 
-// SecretsPost
+// SecretsPost response for creating a new secret
 func SecretsPost(ctx *context.Context) {
 	form := web.GetForm(ctx).(*forms.AddKeyForm)
 	if err := secret_service.InsertRepoSecret(ctx, ctx.Repo.Repository.ID, form.Title, form.Content, form.PullRequestRead); err != nil {
diff --git a/services/secrets/masterkey_nop_test.go b/services/secrets/masterkey_nop_test.go
index 09e4587d4d..f270a6cee4 100644
--- a/services/secrets/masterkey_nop_test.go
+++ b/services/secrets/masterkey_nop_test.go
@@ -1,3 +1,7 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
 package secrets
 
 import (
diff --git a/templates/org/settings/secrets.tmpl b/templates/org/settings/secrets.tmpl
index 24605dfabc..96068c77b5 100644
--- a/templates/org/settings/secrets.tmpl
+++ b/templates/org/settings/secrets.tmpl
@@ -21,14 +21,14 @@
 							</div>
 							<div class="field {{if .Err_Title}}error{{end}}">
 								<label for="title">{{.locale.Tr "repo.settings.secret_key"}}</label>
-								<input id="ssh-key-title" name="title" value="{{.title}}" autofocus required>
+								<input id="key-title" name="title" value="{{.title}}" autofocus required>
 							</div>
 							<div class="field {{if .Err_Content}}error{{end}}">
 								<label for="content">{{.locale.Tr "repo.settings.secret_content"}}</label>
-								<textarea id="ssh-key-content" name="content" placeholder="{{.locale.Tr "repo.settings.secret_value_content_placeholder"}}" required>{{.content}}</textarea>
+								<textarea id="key-content" name="content" placeholder="{{.locale.Tr "repo.settings.secret_value_content_placeholder"}}" required>{{.content}}</textarea>
 							</div>
 							<div class="field">
-								<div class="ui checkbox {{if .Err_IsWritable}}error{{end}}">
+								<div class="ui checkbox {{if .Err_PullRequestRead}}error{{end}}">
 									<input id="pull_request_read" name="pull_request_read" class="hidden" type="checkbox" value="1">
 									<label for="is_writable">
 										{{.locale.Tr "repo.settings.pull_request_read"}}