This shouldn't default to anything – it should either generate a secret randomly and store it in a file for reading (look at how the backpack does it) or crash immediately if there is no secret. Having a default fallback "secret" is a risk because an attacker knows they can always try that string. There is also no indication to someone setting up the server that they might have forgot to set an environment SESSION_SECRET – a typo, or misconfiguration would leave them with the default secret, which is not ideal.

Alternatively, although I like this less, it can use a default secret **only** if NODE_ENV="development", and set a warning for when that happens.