Lots of people still push their Rails secret_token.rb to their GitHub-account: https://www.google.com.au/search?q=secret_token.rb+site%3Agithub.com&ie=utf-8&oe=

Lots of people still push their Rails secret_token.rb to their GitHub-account: https://www.google.com.au/search?q=secret_token.rb+site%3Agithub.com&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:unofficial&client=firefox-a https://www.google.com.au/search?q=secret_token.rb+site%3Agi... But there is a certain probability that the token on the GitHub-page is not identical to the production site's token. (afaik, the token is digested with the user's ID and stored in the user's cookie so a user cannot change his ID while he's signed in - knowledge of the token can let you change your ID to whatever you like)