About that… What about removing the insecure default and documenting it in `local_settings.py`? Django doesn't boot with an empty secret key because it's insecure, and a default key is just as insecure :)