I think what playdoh does by default is ship with a blank secret key (which still works I believe) but will log a warning if it's empty. So it still runs, but you get a big scary "OMG NO SECRET KEY" if you don't set it.

I personally trust a developer to pay attention to that kind of stuff, and if they don't it's not our problem. Presumably, people hack on it more often than deploy? Besides: you have to set it in production no matter what (and anyone who's ever deployed a web app before will know that any app needs a new secret key assigned in a local/env config). But there's no reason to make developers just hacking locally do it.

So that's my argument for leaving it in. It means, for this app, you don't even need a local settings file for development/testing. That's awesome IMO.