Do you want to add a warning "do not shared config files with cookies secret in it" ?
Also we could make the cookie secret maybe in another file in the security folder, or elsewhere.
you configure a path, and if this path is set then server write a random key on it and is able to find it next time.