I am not saying the secret should be in the code itself. The app generator could generate a .gitignore including another dotfile with the secret in it. Or prin

I am not saying the secret should be in the code itself. The app generator could generate a .gitignore including another dotfile with the secret in it. Or print a message on how important it is to configure the secret properly. My point was that a framework should not generate a working value that is insecure. And if generating no value and have the app not start without additional configuration is the best way, this should be the way to go.