Taking a quick look on github, it seems most people are aware of this and have implemented some mechanism to avoid it, being .gitignore or using an env variable

Taking a quick look on github, it seems most people are aware of this and have implemented some mechanism to avoid it, being .gitignore or using an env variable, and a SecureRandom or otherwise generated string for development. https://github.com/search?p=7&q=secret_token+extension%3Arb+path%3A%2Fconfig%2Finitializers%2F&ref=searchresults&type=Code https://github.com/search?p=7&q=secret_token+extension%3Arb+...